Cross-Site Request Forgery Vulnerability in SEOJuice WordPress Plugin
CVE-2026-123046
Key Information:
Badges
What is CVE-2026-123046?
The SEOJuice WordPress plugin prior to version 2.12.0 contains a vulnerability that improperly manages the authentication filter for its REST API interface. This lack of proper restriction allows unauthorized users to bypass the site's REST nonce protection mechanism. Consequently, an attacker could exploit this security gap to execute arbitrary REST actions without authentication, including the creation of a new administrator account. This is facilitated by tricking an authenticated administrator into accessing a maliciously crafted page.
Affected Version(s)
SEOJuice 0 < 2.12.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.