Unauthorized Data Modification in SEO Flow Plugin for WordPress by LupsOnline
CVE-2025-15285

7.5HIGH

Key Information:

Vendor

WordPress
Status
Seo Flow By Lupsonline
Vendor
CVE Published:
4 February 2026

What is CVE-2025-15285?

The SEO Flow plugin by LupsOnline for WordPress is susceptible to unauthorized modifications due to insufficient capability checks in its core authentication functions, checkBlogAuthentication() and checkCategoryAuthentication(). While the plugin implements basic API key authentication, it neglects to enforce appropriate WordPress capability checks. As a result, unauthenticated attackers can exploit this vulnerability to create, alter, or delete blog posts and categories without authorization, posing a significant risk to the integrity of affected WordPress sites.

Affected Version(s)

SEO Flow by LupsOnline 0 <= 2.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/lupsonline-lin...
https://plugins.trac.wordpress.org/changeset?old_path=/lu...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TarcĂ­sio Luchesi De Almeida Silva
.