{"affected":[{"defaultStatus":"unaffected","product":"SEOJuice","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.12.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123046","cwes":["CWE-352"],"description":"The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, including creating a new administrator account, by tricking a logged-in administrator into opening a crafted page (CSRF).","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/4b34187c-bf0d-468e-8e8d-e5297fffeb82/"}],"kev":null,"metrics":[],"modifiedAt":1794636007564,"publishedAt":1794636007564,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/4b34187c-bf0d-468e-8e8d-e5297fffeb82/"}],"remediation":[],"revision":"ce2222c287b692e38b3c7ee209bc79932530d8f49d52fb809b1642ea760f90fb","sources":[{"modifiedAt":1794636007564,"name":"CNA: WPScan","retrievedAt":1794640114767,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123046"}],"ssvc":null,"status":"published","title":"SEOJuice < 2.12.0 - Administrator Account Creation via CSRF","updatedAt":1794640114767}