SEO Flow by LupsOnline WordPress Plugin Missing Capability Check Vulnerability Allowing Unauthenticated Data Modification
Vulnerability
A vulnerability exists in the SEO Flow by LupsOnline plugin for WordPress, in all versions through 2.2.1. The issue arises from a lack of proper capability checks in the checkBlogAuthentication() and checkCategoryAuthentication() functions. These functions only provide basic API key authentication without incorporating WordPress capability checks, enabling unauthenticated attackers to create, modify, and delete blog posts and categories.
Impact
Exploitation of this vulnerability allows for unauthorized creation, modification, and deletion of blog posts and categories.
Added: Feb 4, 2026, 9:27 AM
Updated: Feb 4, 2026, 5:15 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
8.1remediation
0.0relevance
2.5threat
3.2urgency
2.9incentive
4.2Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.