Executive brief
The SEO Flow by LupsOnline WordPress plugin is used to manage search engine optimization settings for WordPress sites. A flaw in the plugin's API credential validation allows unauthenticated attackers to impersonate the site administrator and take complete control of the website, requiring only that the plugin has been configured (which is its default state).
Technical details
The vulnerability is an authentication bypass in the plugin's API request handling (CWE-269: Improper Access Control). The plugin fails to properly validate credentials supplied in API requests, allowing unauthenticated users to be served API responses as if they were the administrator. This is a privilege escalation vulnerability accessible over the network without authentication. An attacker can exploit this to gain full administrative access to the WordPress site. The vulnerability was patched in version 3.0.3; sites running versions 3.0.0 through 3.0.2 are affected.
Affected products
- LupsOnline SEO Flow 3.0.0 - 3.0.2
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 3.0.3