Unauthenticated Post Title and Meta Key Enumeration in SmartCrawl WordPress Plugin

Executive Summary

CVE-2026-16979 is a vulnerability in the SmartCrawl WordPress plugin versions before 3.16.3. It allows users with at least the Subscriber role to access two unauthenticated AJAX actions. These actions can be exploited to read titles of private or draft posts by their IDs and to list stored post-meta key names. The issue occurs because the plugin fails to perform proper capability checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check WordPress sites running SmartCrawl versions prior to 3.16.3. Use WPScan to identify vulnerable installations with: wpscan --url <target_url> --plugins-detection aggressive. Manually test by sending AJAX requests to /wp-admin/admin-ajax.php with actions like smartcrawl_get_post_title or smartcrawl_get_post_meta_keys and Subscriber-level credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to view sensitive content like private or draft post titles and metadata keys. Attackers might gather information about your site's structure or unpublished content, potentially leading to further exploits or data leaks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing private or draft post titles and metadata keys. Unauthorized access to such data may violate confidentiality requirements under these regulations, especially if the exposed information includes personally identifiable information (PII) or protected health information (PHI).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the SmartCrawl plugin to version 3.16.3 or later. If updating is not possible, disable the plugin until patched. Review user roles to ensure no unauthorized Subscriber-level access exists. Monitor for unusual post title or meta key enumeration attempts.

Useful 0 Not Useful 0