CVE-2025-15285

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15285", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-29T22:10:45.399Z", "datePublished": "2026-02-04T08:25:29.295Z", "dateUpdated": "2026-04-08T16:52:49.926Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:49.926Z"}, "affected": [{"vendor": "lupsonline", "product": "SEO Flow by LupsOnline", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories."}], "title": "SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/526837cc-ed1d-4d3d-8f75-a2098445dd1d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lupsonline-link-netwerk/tags/2.2.1/includes/class-linknetwerk-api.php?marks=83-99,101-117#L83"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/lupsonline-link-netwerk/tags/2.2.1&new_path=/lupsonline-link-netwerk/tags/3.0.1&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tarc\u00edsio Luchesi De Almeida Silva"}], "timeline": [{"time": "2025-12-22T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-03T19:31:09.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T17:00:33.826024Z", "id": "CVE-2025-15285", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T17:00:40.302Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15285", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T17:00:33.826024Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T17:00:37.314Z"}}], "cna": {"title": "SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification", "credits": [{"lang": "en", "type": "finder", "value": "Tarc\u00edsio Luchesi De Almeida Silva"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "lupsonline", "product": "SEO Flow by LupsOnline", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-22T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-03T19:31:09.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/526837cc-ed1d-4d3d-8f75-a2098445dd1d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lupsonline-link-netwerk/tags/2.2.1/includes/class-linknetwerk-api.php?marks=83-99,101-117#L83"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/lupsonline-link-netwerk/tags/2.2.1&new_path=/lupsonline-link-netwerk/tags/3.0.1&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:49.926Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15285", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:49.926Z", "dateReserved": "2025-12-29T22:10:45.399Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-04T08:25:29.295Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SEO Flow by LupsOnline", "vendor": "lupsonline", "versions": [{"lessThanOrEqual": "2.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories."}, {"lang": "es", "value": "El plugin SEO Flow de LupsOnline para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en las funciones checkBlogAuthentication() y checkCategoryAuthentication() en todas las versiones hasta la 2.2.1, inclusive. Estas funciones de autorizaci\u00f3n solo implementan autenticaci\u00f3n b\u00e1sica de clave API, pero no implementan comprobaciones de capacidad de WordPress. Esto hace posible que atacantes no autenticados creen, modifiquen y eliminen publicaciones de blog y categor\u00edas."}], "id": "CVE-2025-15285", "lastModified": "2026-06-17T08:37:31.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15285", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T17:00:33.826024Z", "version": "2.0.3"}}]}, "published": "2026-02-04T09:15:50.863", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lupsonline-link-netwerk/tags/2.2.1/includes/class-linknetwerk-api.php?marks=83-99,101-117#L83"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/lupsonline-link-netwerk/tags/2.2.1&new_path=/lupsonline-link-netwerk/tags/3.0.1&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/526837cc-ed1d-4d3d-8f75-a2098445dd1d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T23:50:09.802846+00:00", "value": {"mitigation_remediation": ["Upgrade the SEO Flow by LupsOnline plugin to version 3.0.1 or later.", "If an upgrade is not feasible, block the API endpoints in the WordPress configuration or through a firewall to prevent unauthenticated access.", "Enable the WordPress capability checks in your custom code or request the plugin author to add them, ensuring users must have proper capabilities to modify posts or categories."], "summary": {"action": "Patch Immediately", "impact": "Unauthenticated arbitrary modification of posts and categories"}, "threat_synthesis": {"affected_systems": "All installations of the SEO Flow by LupsOnline plugin for WordPress released through version 2.2.1 are affected. The vulnerability arises from the plugin\u2019s authentication functions and is present in every build up to that point, regardless of the WordPress version or host configuration.", "description_and_impact": "The SEO Flow by LupsOnline plugin contains missing capability checks in its checkBlogAuthentication() and checkCategoryAuthentication() functions for versions up to and including 2.2.1. These functions rely solely on a basic API key and do not enforce WordPress capability checks, allowing attackers without authentication to create, modify, or delete blog posts and categories. This compromise of content integrity can be used for defacement, misinformation, or injection of malicious content into the website.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the likely attack vector is via unauthenticated HTTP requests to the plugin\u2019s API endpoints, with no additional privileges or nonces required. Successful exploitation would grant an attacker full control over the site\u2019s content, with potential impacts on confidentiality, integrity, and availability of published material."}}}}, "created": "2026-02-04T21:18:17.156608+00:00", "updated": "2026-04-22T00:00:03.943374+00:00", "vendors": ["lupsonline", "lupsonline$PRODUCT$seo_flow", "wordpress", "wordpress$PRODUCT$wordpress"]}