EUVD-2026-71851
GHSA-rp68-vhcr-9v26
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site with configured SEO Flow plugin
-
DeliverySend crafted API request with invalid credential
-
ExploitPlugin serves request as administrator
-
ExecutionPerform privileged admin actions
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The single required precondition is that the SEO Flow by LupsOnline plugin (below 3.0.3) has been configured with an administrator's credential - which the description explicitly notes is its normal operating state, so this is not a limiting factor in practice. No authentication, no user interaction, and no non-default settings are needed; exploitation is remote and unauthenticated against any site where the plugin is installed and set up. The only genuine limiter on real-world exploitation is the plugin's small deployment footprint, not any technical barrier. |
| Impact | The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated, network-reachable, low-complexity exploitation with full confidentiality, integrity, and availability impact - consistent with site takeover. This is corroborated by public exploit code (WPScan), which materially raises real-world exploitability, so any operator running a configured, unpatched instance should treat this as urgent and patch immediately. However, EPSS is only 0.15% (4th percentile), indicating that broad, automated internet-wide exploitation has not (yet) been observed; this likely reflects the plugin's limited install base rather than any technical difficulty, since the exploit is trivial once a target is identified. The CVSS network vector and description agree (API request over the network with no auth), so there is no signal conflict here. It is not listed in CISA KEV. Net assessment: genuine high priority for anyone running the plugin, but the aggregate population at risk is small. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a WordPress site running a configured SEO Flow by LupsOnline plugin below 3.0.3 and sends a crafted API request with an invalid or absent credential. Because the plugin fails to validate the credential correctly, the request is processed with the configuring administrator's privileges, letting the attacker perform admin actions and take over the site. Public exploit code from WPScan makes this straightforward to reproduce against vulnerable installations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.
RemediationAI
Upgrade the SEO Flow by LupsOnline plugin to version 3.0.3 or later, which is the vendor-released patch that corrects the API credential validation (Vendor-released patch: 3.0.3). If immediate patching is not possible, disable and deactivate the plugin, or restrict access to the plugin's API/AJAX endpoints at the web-server or WAF layer to trusted addresses only - noting that deactivating the plugin removes its SEO functionality and endpoint filtering may break legitimate integrations that rely on the API. As an interim hardening step, place the site behind a WordPress-aware WAF with virtual-patching rules for this CVE. Refer to the WPScan advisory (https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/) for exploitation details and confirmation of the fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the SEO Flow by LupsOnline plugin for WordPress, a third-party SEO management extension configured with an administrator's API credential. The root cause is CWE-269 (Improper Privilege Management): the plugin fails to correctly validate the credential presented on incoming API requests, so requests that should be rejected are instead processed as though they originated from the configuring administrator. This is a classic privilege-escalation / broken-authentication pattern in WordPress REST/AJAX handler code, where a missing or improperly compared secret allows the request to inherit a privileged identity. The CPE 'cpe:2.3:a:unknown:seo_flow_by_lupsonline' lists the vendor as 'unknown', a placeholder; the actual vendor is LupsOnline and the platform is WordPress.
Know when Seo Flow By Lupsonline gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network API request with no user interaction yields administrator context (PR:N/AC:L/UI:N), and full admin control implies complete confidentiality, integrity, and availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
Technical POC Analysis
Bug class: CWE-269 Improper Privilege Management.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The SEO Flow by LupsOnline WordPress plugin (versions 3.0.0-3.0.2) contains a critical authentication bypass that allows unauthenticated attackers to assume administrator privileges and achieve complete site takeover, including data access and malware injection capabilities. Organizations running affected versions must patch immediately; a vendor fix (version 3.0.3 or later) is available and resolves the vulnerability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB