SmartCrawl SEO checker, analyzer & optimizer <= 3.16.4 - Authenticated (Contributor+) Missing Authorization to Post SEO Analysis Modification and Disclosure
- ID
- WPSEC-2026-1011
- Plugin
- SmartCrawl SEO checker, analyzer & optimizer (smartcrawl-seo)
- Affected
- all versions before 3.17.1
- Remediation
- Update to 3.17.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- SmartCrawl SEO checker, analyzer & optimizer on WPSec AttackSurface
- Fix released
- Published
Description
The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized access and modification of data via its post analysis AJAX actions in all versions up to, and including, 3.16.4, due to missing capability checks. The handlers that ignore and restore SEO checks, update focus keyphrases and return analysis results verified only a nonce that is available to every user who can open the post list or the post editor, and never checked whether the user could edit or read the target post. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the ignored SEO checks and focus keyphrases of posts they cannot edit, and to read the focus keyphrases and SEO and readability results of posts they cannot read, including private and draft posts.
References
- https://wpsec.com/vuln/WPSEC-2026-1011/
- https://plugins.svn.wordpress.org/smartcrawl-seo/tags/3.17.1/
- https://wordpress.org/plugins/smartcrawl-seo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS