Live › vulnerability › CVE-2026-110901
Go to dashboardSmartCrawl, a WordPress SEO plugin by WPMU DEV, has an authorization bypass where a user-controlled key lets requests get past access control. The sources do not say what data or actions an attacker gains beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the SmartCrawl (smartcrawl-seo) WordPress plugin at version or earlier are in the affected range, per the NVD description. The sources do not describe which configuration or role makes a site exposed, so unknown whether sites that do not use the affected feature are safe.
3.16.4No product ranges from the sources yet.
wp plugin get smartcrawl-seo --field=version3.16.4, per the vendor's release notesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-110901")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.