{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-27T04:09:17.730","vulnerabilities":[{"cve":{"id":"CVE-2025-15285","sourceIdentifier":"security@wordfence.com","published":"2026-02-04T09:15:50.863","lastModified":"2026-06-17T08:37:31.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories."},{"lang":"es","value":"El plugin SEO Flow de LupsOnline para WordPress es vulnerable a la modificación no autorizada de datos debido a una comprobación de capacidad faltante en las funciones checkBlogAuthentication() y checkCategoryAuthentication() en todas las versiones hasta la 2.2.1, inclusive. Estas funciones de autorización solo implementan autenticación básica de clave API, pero no implementan comprobaciones de capacidad de WordPress. Esto hace posible que atacantes no autenticados creen, modifiquen y eliminen publicaciones de blog y categorías."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"lupsonline","product":"SEO Flow by LupsOnline","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-04T17:00:33.826024Z","id":"CVE-2025-15285","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/lupsonline-link-netwerk/tags/2.2.1/includes/class-linknetwerk-api.php?marks=83-99,101-117#L83","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=/lupsonline-link-netwerk/tags/2.2.1&new_path=/lupsonline-link-netwerk/tags/3.0.1&sfp_email=&sfph_mail=","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526837cc-ed1d-4d3d-8f75-a2098445dd1d?source=cve","source":"security@wordfence.com"}]}}]}