CVE-2026-110901: WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SmartCrawl pluginto a version that resolves this vulnerability.Fixed in 3.17.1
Event History
Frequently Asked Questions
What level of access does an attacker need?
The vulnerability requires low-level privileges. It is remotely exploitable and does not require user interaction.
What impact could successful exploitation have?
Successful exploitation may allow unauthorized access to information and unauthorized modification of information. The stated impact is low for confidentiality and integrity, with no availability impact.
Which SmartCrawl versions are affected?
The issue affects WPMU DEV SmartCrawl through version 3.16.4. No fixed version is identified in the provided information.