CVE-2026-78362 — CRITICAL (9.8)

Vulnerability Description

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-269

References

https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/

FAQ

What is CVE-2026-78362?

CVE-2026-78362 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who...

How severe is CVE-2026-78362?

CVE-2026-78362 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-78362?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.