CVE-2026-123046: SEOJuice < 2.12.0 - Administrator Account Creation via CSRF
The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, including creating a new administrator account, by tricking a logged-in administrator into opening a crafted page (CSRF).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.12.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites running SEOJuice versions earlier than 2.12.0 are exposed. Exploitation requires a logged-in administrator to be induced to open an attacker-controlled crafted page.
Does exploitation require the attacker to log in first?
No. The attacker can be unauthenticated, but relies on the victim administrator's authenticated WordPress session to perform cookie-authenticated REST actions.
What is the practical impact of the REST nonce protection failure?
REST nonce protection is disabled for the whole site, not only for SEOJuice endpoints. An attacker may cause any cookie-authenticated REST action in the administrator's session, including creation of a new administrator account.
What should be done if an immediate update is not possible?
The provided information does not identify a workaround. Reducing exposure requires preventing administrators from opening untrusted crafted pages until SEOJuice can be updated to 2.12.0 or later.