Description

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T06:17:36.013Z",
  "pubdate": "2026-08-19T06:17:36.013Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before version 3.16.3. The security flaw stems from an insufficient capability validation mechanism implemented across two specific AJAX action handlers. This architectural oversight permits authenticated users possessing minimal privileges, specifically those assigned the Subscriber role, to interact with backend functionalities reserved for higher-privileged users. The primary business and security impact involves unauthorized information disclosure, specifically exposing sensitive metadata structures and the titles of unpublished content, including draft and private posts. Attackers leverage standard low-privilege authentication vectors to harvest metadata keys and unauthorized content references, potentially aiding subsequent targeted exploitation or reconnaissance phases against the underlying WordPress installation. Exploitation requires network access to the target WordPress application and a valid user account with subscriber-level access or higher, but does not necessitate complex interaction beyond standard AJAX requests targeting the exposed endpoints.",
  "technicalDetails": "The vulnerability resides within the AJAX action handling mechanisms of the SmartCrawl SEO checker, analyzer & optimizer WordPress plugin affecting versions prior to 3.16.3. The root cause of the security deficit is the complete absence or improper implementation of capability checks (such as current_user_can() calls) within two distinct AJAX action endpoints provided by the plugin. In WordPress architecture, AJAX actions intended for administrative or elevated operations must explicitly verify that the executing user possesses the requisite administrative capabilities before processing requests or querying the database. Because these specific endpoints fail to validate user permissions, any authenticated user authenticated at the Subscriber level or higher can successfully invoke these AJAX actions.\nThe attack flow proceeds as follows: An authenticated attacker with a low-privilege Subscriber account crafts HTTP requests targeting the WordPress AJAX endpoint (admin-ajax.php) specifying the vulnerable plugin actions. Due to the missing capability checks, the plugin processes the requests and interacts with the WordPress database via underlying functions. The first exposed functionality allows the retrieval of post titles corresponding to arbitrary post IDs, bypassing visibility restrictions to expose private and draft posts. The second vulnerable action enables the enumeration of stored post-meta key names across the database. This unauthorized data harvesting yields internal structural information regarding custom fields and unreleased content titles. The network exposure is constrained only by the requirement of a valid subscriber-level session, and no complex payloads or memory corruption primitives are required, as the flaw represents a pure logic-based access control failure."
}