CrawlWP SEO CVE-2026-59520

Exploitation requires that the target is a WordPress site administrator (or user with sufficient plugin management privileges) with an active authenticated session at the time of the attack. The victim must be deceived into visiting an attacker-controlled web page - passive user interaction (UI:R) is mandatory; the attack cannot proceed without it. No special server-side configuration beyond running CrawlWP SEO version 3.0.16 or earlier is required. Exploitation is limited by the requirement for simultaneous admin authentication and social engineering success. Unauthenticated or non-admin WordPress users cannot be leveraged as victims for this attack. Remote unauthenticated exploitation without victim interaction is not possible.

Real-world risk is low-to-moderate. The CVSS 4.3 score is credible and not inflated: AV:N and AC:L confirm easy network-based triggering, but UI:R introduces a meaningful exploitation barrier requiring the target administrator to interact with attacker-controlled content during an active WordPress session. The scope is unchanged (S:U) and impact is integrity-only at low severity (I:L), meaning no data exfiltration and no direct service disruption. EPSS data is not provided, but given the CSRF class and low impact scope, probabilistic exploitation likelihood is expected to be low. No CISA KEV listing exists, and no POC has been identified. The practical risk is further bounded by requiring a victim who is simultaneously authenticated to the WordPress admin panel and deceived into visiting a malicious page - a narrower attack surface than fully unauthenticated network-exploitable flaws. For sites with multiple administrators or high-value SEO configurations, the risk warrants patching but does not constitute an emergency.

An attacker crafts a malicious web page containing a hidden HTML form that auto-submits a forged POST request to the target WordPress site's CrawlWP SEO admin endpoint. If a WordPress administrator with an active session visits this page - via a phishing email or a compromised third-party site - the browser silently sends the request using the admin's session cookie, causing the plugin to process the forged action as legitimate. No public exploit code has been identified, but CSRF exploits of this class are trivial to construct without specialized tooling.