{"id":"CVE-2026-123046","kind":"vulnerability","aliases":["CVE-2026-123046"],"related":[],"title":"SEOJuice WordPress plugin: CSRF lets attackers create admin accounts","description":"The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, including creating a new administrator account, by tricking a logged-in administrator into opening a crafted page (CSRF).","summary":"The SEOJuice WordPress plugin before 2.12.0 disables WordPress's REST nonce protection site-wide, so a crafted page can make a logged-in administrator's browser run privileged REST actions. An attacker can use this to create a new administrator account on the site.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","seojuice","wordpress"],"not_affected_if":["plugin-not-installed","version-2.12.0-or-later"],"how_to_check":"- Check the installed SEOJuice plugin version in the WordPress admin Plugins screen or `wp plugin get seojuice --field=version` (unknown if the plugin slug differs)\n- Review the user list for unexpected administrator accounts","fix":"- SEOJuice WordPress plugin: upgrade to `2.12.0` or later","status":"open","published_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:12+00:00","updated_at":"2026-11-14T07:28:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-14T07:28:12Z","model":"claude-haiku-5-5","output":{"fix":"- SEOJuice WordPress plugin: upgrade to `2.12.0` or later","reach":"internet","title":"SEOJuice WordPress plugin: CSRF lets attackers create admin accounts","impact":"high","summary":"The SEOJuice WordPress plugin before 2.12.0 disables WordPress's REST nonce protection site-wide, so a crafted page can make a logged-in administrator's browser run privileged REST actions. An attacker can use this to create a new administrator account on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","seojuice"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker creates a new administrator account on the site","analyst_note":"","how_to_check":"- Check the installed SEOJuice plugin version in the WordPress admin Plugins screen or `wp plugin get seojuice --field=version` (unknown if the plugin slug differs)\n- Review the user list for unexpected administrator accounts","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.12.0-or-later"],"who_is_affected":"Sites running the SEOJuice WordPress plugin before 2.12.0 are exposed, and the attack needs a logged-in administrator to open a crafted page. Sites without the plugin, or running 2.12.0 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4577,"output_tokens":545,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123046':12A,15A '-2026':11A,14A '2.12.0':24B,70C 'account':9A,61B,107C 'action':50B,101C 'admin':8A 'administr':44B,60B,106C,114C 'allow':91C 'api':77C 'attack':6A,52B,93C 'authent':78C,99C 'browser':46B 'cooki':98C 'cookie-authent':97C 'correct':73C 'craft':36B,118C 'creat':7A,57B,103C 'csrf':4A,120C 'cve':10A,13A 'disabl':25B,80C 'filter':79C 'includ':102C 'let':5A 'log':42B,112C 'logged-in':41B,111C 'make':39B 'new':59B,105C 'nonc':29B,84C 'open':116C 'packag':16B 'page':37B,119C 'perform':95C 'plugin':3A,22B,68C 'privileg':48B 'protect':30B,85C 'rest':28B,49B,76C,83C,100C 'restrict':74C 'run':47B 'seojuic':1A,17B,20B,66C 'site':32B,64B,89C 'site-wid':31B 'trick':109C 'unauthent':92C 'use':54B 'whole':88C 'wide':33B 'wordpress':2A,18B,21B,26B,67C,81C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SEOJuice WordPress plugin before 2.12.0 are exposed, and the attack needs a logged-in administrator to open a crafted page. Sites without the plugin, or running 2.12.0 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","seojuice","wordpress"],"campaign_type":null,"search_a":"'-123046':12A,15A '-2026':11A,14A 'account':9A 'admin':8A 'attack':6A 'creat':7A 'csrf':4A 'cve':10A,13A 'let':5A 'plugin':3A 'seojuic':1A 'wordpress':2A","search_b":"'2.12.0':24B 'account':61B 'action':50B 'administr':44B,60B 'attack':52B 'browser':46B 'craft':36B 'creat':57B 'disabl':25B 'log':42B 'logged-in':41B 'make':39B 'new':59B 'nonc':29B 'packag':16B 'page':37B 'plugin':22B 'privileg':48B 'protect':30B 'rest':28B,49B 'run':47B 'seojuic':17B,20B 'site':32B,64B 'site-wid':31B 'use':54B 'wide':33B 'wordpress':18B,21B,26B","search_c":"'2.12.0':70C 'account':107C 'action':101C 'administr':106C,114C 'allow':91C 'api':77C 'attack':93C 'authent':78C,99C 'cooki':98C 'cookie-authent':97C 'correct':73C 'craft':118C 'creat':103C 'csrf':120C 'disabl':80C 'filter':79C 'includ':102C 'log':112C 'logged-in':111C 'new':105C 'nonc':84C 'open':116C 'page':119C 'perform':95C 'plugin':68C 'protect':85C 'rest':76C,83C,100C 'restrict':74C 'seojuic':66C 'site':89C 'trick':109C 'unauthent':92C 'whole':88C 'wordpress':67C,81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123046","severity":null,"published_at":"2026-11-14T07:17:19+00:00","modified_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}