Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-04 | 2 | Disclosure1General1 |
| 2026-02-09 | 1 | Disclosure1 |
CVE-2025-15285 The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() … https://www.cve.org/CVERecord?id=CVE-2025-15285
Post summary
CVE‑2025‑15285 allows unauthorized data modification in the SEO Flow WordPress plugin because of a missing capability check.
CVE-2025-15285 (CVSS:7.5, HIGH) is Awaiting Analysis. The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa..https://nvd.nist.gov/vuln/detail/CVE-2025-15285 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
A new CVE (2025-15285) affecting the SEO Flow WordPress plugin has been reported with a high CVSS score and awaits analysis, but no exploit or patch details are provided.
CVE-2025-15285 SEO Flow WordPress Plugin Unauthorized Data Modification via Authentication Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15285
Post summary
A newly identified CVE (CVE-2025-15285) for the SEO Flow WordPress plugin allows unauthorized data modification by bypassing authentication, as reported on Vulmon.