PT-2026-5885 · WordPress · Seo Flow

Published 2026-02-04 · Updated 2026-02-09 · CVE-2025-15285

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SEO Flow versions prior to 2.2.2

Description The SEO Flow plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check within the checkBlogAuthentication() and checkCategoryAuthentication() functions. These functions rely solely on API key authentication without enforcing WordPress capability checks, allowing unauthenticated attackers to create, modify, and delete blog posts and categories.

Recommendations Update the SEO Flow plugin to version 2.2.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15285

Affected Products

Seo Flow

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-15285 · Security Note
• https://plugins.trac.wordpress.org/browser/lupsonline-link-netwerk/tags/2.2.1/includes/class-linknetwerk-api.php?marks=83-99,101-117#L83 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/526837cc-ed1d-4d3d-8f75-a2098445dd1d?source=cve · Note
• https://t.me/CVEtracker/43700 · Telegram Post
• https://twitter.com/cracbot/status/2020814987657416824 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=/lupsonline-link-netwerk/tags/2.2.1&new_path=/lupsonline-link-netwerk/tags/3.0.1&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/150830 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2019026974056853650 · Twitter Post