CVE-2026-78362
Critical
Description
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSEO Flow by LupsOnline
PublishedSep 5, 2026
First seenSep 5, 2026
Weakness typeCWE-269Improper privilege management
How to fix
Update
- SEO Flow by LupsOnline3.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SEO Flow by LupsOnline | 3.0.0 ≤ v < 3.0.3 | 3.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.