CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_submodule() function in all versions up to, and including, 3.14.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setttings.
Explanation of Vulnerability in Simple Terms
SmartCrawl SEO checker versions up to 3.14.3 contain an access control flaw that allows authenticated users to modify data they should not have permission to change. An attacker with a low-privilege account can alter site content or settings through the plugin. Update to a version newer than 3.14.3 to resolve this issue.
What an attacker can do
Modify site data or settings that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized changes to SEO settings, site content, or plugin configuration by low-privilege users.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor).
Key dates
External resources
