Description
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
Published: 2026-10-16
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Access
Action: Immediate Patch
AI Analysis

Impact

An IDOR flaw in WPMU DEV SmartCrawl allows attackers to manipulate user‑controlled keys, bypassing access control checks and potentially accessing restricted data or resources within the WordPress installation. This flaw is classified as CWE‑639 and can result in unauthorized data exposure or modification.

Affected Systems

WordPress installations that use the SmartCrawl SEO plugin version 3.16.4 or earlier are affected. The vendor issuing the fix is WPMU DEV under the SmartCrawl product line. The vulnerability existed through version 3.16.4 and is resolved in later releases.

Risk and Exploitability

With a CVSS base score of 5.4, the flaw presents a moderate risk. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is via crafted HTTP requests sent to the plugin’s endpoints, which an attacker can use to manipulate query parameters and gain unauthorized access. Based on the description, it is inferred that the exploitation requires no authentication beyond the normal WordPress user session, making the exploit feasible for users with minimal privileges.

Generated by OpenCVE AI on October 16, 2026 at 16:35 UTC.

Remediation

Vendor Solution

Update the WordPress SmartCrawl plugin to the latest available version (at least 3.17.1).

OpenCVE Recommended Actions

  • Update the SmartCrawl plugin to version 3.17.1 or later.
  • Remove or disable the plugin if it is not required.
  • Review and restrict WordPress user roles and capabilities to limit access to plugin management.

Generated by OpenCVE AI on October 16, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
Title WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-16T14:59:30.929Z

Reserved: 2026-10-15T00:19:27.828Z

Link: CVE-2026-110901

cve-icon Vulnrichment

Updated: 2026-10-16T14:59:21.343Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T13:16:55.250

Modified: 2026-10-16T15:19:36.177

Link: CVE-2026-110901

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T16:45:14Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key