WordPress Plugin Vulnerabilities

SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

Description

The plugin does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the plugin and take over the site. Exploitation requires the plugin to have been configured, which is its normal operating state.

Proof of Concept

Affects Plugins

Plugin icon
lupsonline-link-netwerk
Fixed in 3.0.3

References

CVE
CVE-2026-78362

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
0833424b-1231-4a48-be90-13fe4edc60c9

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-04 (about 8 hours ago)

Other

Published
Title
Published
2026-09-03
Title
ACPT (Premium) < 2.0.67 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
Published
2026-06-08
Title
Events Calendar for GeoDirectory < 2.3.29 - Subscriber+ Privilege Escalation
Published
2025-04-24
Title
Service Finder Bookings < 6.0 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'
Published
2019-08-06
Title
ND Learning <= 4.7 - Unauthenticated Options Change
Published
2026-07-17
Title
Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration