CVE-2026-123046

UNKNOWN 0.0

SEOJuice < 2.12.0 - Administrator Account Creation via CSRF

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, including creating a new administrator account, by tricking a logged-in administrator into opening a crafted page (CSRF).

Vendor	unknown
Product	seojuice
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for unknown seojuice

Be the first to know when new unknown vulnerabilities affecting unknown seojuice are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / SEOJuice

0 < 2.12.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/4b34187c-bf0d-468e-8e8d-e5297fffeb82/

Credits

Enrico Marcolini Claudio Marchesini Dottor Marc WPScan