CVE-2026-16979: SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with at least the Subscriber role can exploit the affected AJAX actions. The issue does not require editor, author, or administrator capabilities.
What information can an attacker obtain?
An attacker can read titles of private and draft posts when they know or can test post IDs. They can also enumerate the names of stored post-meta keys, which may reveal information about site configuration or content metadata.
Are unauthenticated visitors affected?
The available information identifies exploitation by authenticated users with at least the Subscriber role. It does not state that unauthenticated users can access the vulnerable actions.
What versions are affected?
SmartCrawl versions before 3.16.3 are affected. Updating to version 3.16.3 or later addresses the missing capability checks described.