WordPress Plugin Vulnerabilities

SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration

Description

The plugin does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.

Proof of Concept

Affects Plugins

Plugin icon
smartcrawl-seo
Fixed in 3.16.3

References

CVE
CVE-2026-16979

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ezekiel Victor
Submitter
Ezekiel Victor
Verified
Yes
WPVDB ID
c9eb27aa-c5f9-4f1c-b87c-337ebaf192dd

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2025-03-27
Title
Support Genix < 1.4.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-07-18
Title
GiveWP – Donation Plugin and Fundraising Platform < 3.14.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
Published
2026-01-02
Title
Verdure <= 1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2022-11-24
Title
WooCommerce Product Vendors < 2.1.69 - Vendor Commission Percentage Update via IDOR
Published
2026-08-03
Title
Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure