{"api_version":"1","generated_at":"2026-09-05T09:12:51+00:00","cve":"CVE-2026-78362","urls":{"html":"https://cve.report/CVE-2026-78362","api":"https://cve.report/api/cve/CVE-2026-78362.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-78362","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-78362"},"summary":{"title":"SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication","description":"The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-09-05 07:17:12","updated_at":"2026-09-05 07:17:12"},"problem_types":["CWE-269 Improper Privilege Management"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/","name":"https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78362","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78362","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"SEO Flow by LupsOnline","version":"affected 3.0.0 3.0.3 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Naoki Kawahigashi","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"SEO Flow by LupsOnline","vendor":"Unknown","versions":[{"lessThan":"3.0.3","status":"affected","version":"3.0.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Naoki Kawahigashi"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state."}],"problemTypes":[{"descriptions":[{"description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-05T06:00:05.647Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/0833424b-1231-4a48-be90-13fe4edc60c9/"}],"source":{"discovery":"EXTERNAL"},"title":"SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-78362","datePublished":"2026-09-05T06:00:05.647Z","dateReserved":"2026-08-24T11:38:36.046Z","dateUpdated":"2026-09-05T06:00:05.647Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-05 07:17:12","lastModifiedDate":"2026-09-05 07:17:12","problem_types":["CWE-269 Improper Privilege Management"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"78362","Ordinal":"1","Title":"SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege","CVE":"CVE-2026-78362","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"78362","Ordinal":"1","NoteData":"The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.","Type":"Description","Title":"SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege"}]}}}