The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before version 3.16.3 fails to verify user capabilities for two AJAX actions. As a result, any authenticated user with the Subscriber role or higher can request the titles of private or draft posts by ID and can list the names of stored post‑meta keys, revealing information that should remain confidential.

This vulnerability affects the SmartCrawl SEO checker, analyzer & optimizer WordPress plugin of unknown vendor for all releases earlier than 3.16.3. The plugin must be upgraded to 3.16.3 or later to eliminate the flaw.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, meaning no widespread exploitation has been documented. The attack surface is limited to authenticated users who can reach the plugin’s AJAX endpoints, typically via standard HTTP requests. An attacker with a Subscriber account can gain insight into unpublished content and the structure of post meta, which could aid in planning further attacks against the site.