{
 "id": "WPSEC-2026-1011",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1011/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1011/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1011/index.md",
 "title": "SmartCrawl SEO checker, analyzer & optimizer <= 3.16.4 - Authenticated (Contributor+) Missing Authorization to Post SEO Analysis Modification and Disclosure",
 "description": "The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized access and modification of data via its post analysis AJAX actions in all versions up to, and including, 3.16.4, due to missing capability checks. The handlers that ignore and restore SEO checks, update focus keyphrases and return analysis results verified only a nonce that is available to every user who can open the post list or the post editor, and never checked whether the user could edit or read the target post. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the ignored SEO checks and focus keyphrases of posts they cannot edit, and to read the focus keyphrases and SEO and readability results of posts they cannot read, including private and draft posts.",
 "plugin": {
  "slug": "smartcrawl-seo",
  "name": "SmartCrawl SEO checker, analyzer & optimizer",
  "full_name": "SmartCrawl SEO checker, analyzer & optimizer",
  "wordpress_org": "https://wordpress.org/plugins/smartcrawl-seo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/smartcrawl-seo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/smartcrawl-seo"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.17.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.17.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.17.1",
 "remediation": "Update to 3.17.1 or later.",
 "fix_released": "2026-10-14T12:06:32+00:00",
 "published": "2026-10-15T12:51:52+00:00",
 "updated": "2026-10-14T19:50:18.478622+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1011/",
  "https://plugins.svn.wordpress.org/smartcrawl-seo/tags/3.17.1/",
  "https://wordpress.org/plugins/smartcrawl-seo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/smartcrawl-seo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}