CVE-2026-16979CWE-639

CVE-2026-16979

Medium · published August 19, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-19T10:17Z
References (1)
https://wpscan.com/vulnerability/c9eb27aa-c5f9-4f1c-b87c-337ebaf192dd/ · [email protected]
EPSS history
Timeline
  • 19 AUG 06:00Z
    SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
    cvelistv5