# SmartCrawl SEO checker, analyzer & optimizer <= 3.16.4 - Authenticated (Contributor+) Missing Authorization to Post SEO Analysis Modification and Disclosure

- **ID:** WPSEC-2026-1011
- **Plugin:** SmartCrawl SEO checker, analyzer & optimizer (`smartcrawl-seo`), https://wordpress.org/plugins/smartcrawl-seo/
- **Affected versions:** all versions before 3.17.1
- **Fixed in:** 3.17.1 (Update to 3.17.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/smartcrawl-seo
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1011/

## Description

The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized access and modification of data via its post analysis AJAX actions in all versions up to, and including, 3.16.4, due to missing capability checks. The handlers that ignore and restore SEO checks, update focus keyphrases and return analysis results verified only a nonce that is available to every user who can open the post list or the post editor, and never checked whether the user could edit or read the target post. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the ignored SEO checks and focus keyphrases of posts they cannot edit, and to read the focus keyphrases and SEO and readability results of posts they cannot read, including private and draft posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1011/
- https://plugins.svn.wordpress.org/smartcrawl-seo/tags/3.17.1/
- https://wordpress.org/plugins/smartcrawl-seo/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1011/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.