SmartCrawl CVE-2026-110901

Requires an authenticated session on the target WordPress site: per the CVSS vector PR:L, the attacker must already hold a low-privilege account (e.g., subscriber/contributor-level or any registered user), which limits exploitation to sites that allow or have such accounts. No user interaction and no special non-default configuration is indicated by the input. The vulnerable component is the SmartCrawl (smartcrawl-seo) plugin at versions from an unspecified start through 3.16.4; sites on later versions are not affected. The limiting factor is the authentication requirement - this is not a remote-unauthenticated flaw - which meaningfully constrains real-world risk relative to the network attack vector.

This is a moderate-severity, low-priority issue absent additional exploitation signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L) - i.e., any authenticated account such as a subscriber or contributor - with no user interaction, yielding only low confidentiality and low integrity impact and no availability impact. There is no public exploit identified at time of analysis (no POC indicator in the input), the CVE is not listed in CISA KEV, and no EPSS probability was supplied, so there is no evidence of active or likely imminent exploitation. The CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR) classification is consistent with the PR:L and partial-impact scoring: an authenticated user manipulates an object reference to access or modify data outside their authorization scope. Net assessment: a legitimate IDOR worth patching on normal cadence, but not a drop-everything priority. Key missing signals to note explicitly: EPSS score is absent (cannot quantify exploitation probability), POC/exploit-code status is not stated in the input, and no independent vendor advisory beyond the Patchstack database entry was provided to confirm affected-version boundaries.

An attacker who holds any low-privilege authenticated account on a WordPress site running SmartCrawl 3.16.4 or earlier submits a request manipulating a user-controlled object identifier (key/ID) to read or alter SEO configuration or data belonging to other users or resources they should not reach. Because the attack is network-based, low-complexity, and needs no victim interaction (AV:N/AC:L/UI:N), it can be performed directly against the plugin's endpoints once authenticated. No public exploit code was identified at time of analysis.