CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the save_settings function in all versions up to, and including, 3.10.2. This makes it possible for unauthenticated attackers to save schema types.
Explanation of Vulnerability in Simple Terms
SmartCrawl SEO checker versions up to 3.10.2 lack proper authorization checks on certain functions. An attacker without authentication can modify site data through the plugin's API endpoints. The vulnerability has a low integrity impact and requires no user interaction to exploit.
What an attacker can do
Modify site data via unprotected plugin API endpoints without authentication.
Potential impact on your site
Attackers can alter SEO settings, metadata, or other plugin-managed data without your permission.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
