CVE-2026-110901: Authorization Bypass via User-Controlled Key (IDOR) in WPMU DEV SmartCrawl up to 3.16.4

Summary

CVE-2026-110901 describes an Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl, the WordPress SEO plugin distributed under the slug smartcrawl-seo. All plugin versions from n/a through 3.16.4 fall within the affected range. The National Vulnerability Database tracks the issue as CWE-639 and states that it allows Exploiting Incorrectly Configured Access Control Security Levels. The CVSS 3.1 base score is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), rated medium: the flaw is remotely exploitable by a low-privileged authenticated user, requires no user interaction, and carries low confidentiality and integrity impact with no availability impact. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The National Vulnerability Database classifies this issue as CWE-639, Authorization Bypass Through User-Controlled Key. As a weakness class, CWE-639 describes systems that accept a key or identifier supplied by the user to select an object, then act on that object without verifying that the authenticated user is authorized to perform the requested action on it. Authentication is checked; object-level authorization is not. The consequence is that a user can substitute a different key value and reach data or functionality that belongs to someone else, because the identifier, rather than the permission model, decides what the request touches.

Bug bounty hunters know this weakness class under its operational name, IDOR, Insecure Direct Object Reference. The Patchstack advisory entry for this CVE is catalogued in its vulnerability database under exactly that terminology; the advisory URL itself names the issue as an insecure direct object references (IDOR) vulnerability in the SmartCrawl plugin at version 3.16.4. The CWE-639 classification and the IDOR label describe the same underlying mistake from two angles: the CWE names the weakness, the IDOR label names the exploitation pattern.

The NVD description adds a second characterization: the vulnerability allows Exploiting Incorrectly Configured Access Control Security Levels. In plain terms, an access control check inside the plugin exists but is configured at the wrong level of strictness. Common shapes of this mistake include verifying only that a request is authenticated while skipping a capability or ownership check, enforcing a capability check on one part of a request but not on the parameter that selects the target object, or applying a permission rule weaker than the sensitivity of the data being returned. The description does not identify the specific function, hook, endpoint, or parameter involved in SmartCrawl; those implementation details are not fully disclosed in the provided sources.

The CVSS 3.1 vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, breaks down as follows:

AV:N, Attack Vector: Network. The vulnerability is exploitable across a network boundary; a remote attacker with network access to the target WordPress site is within scope.
AC:L, Attack Complexity: Low. No unusual conditions must hold beyond the vulnerable configuration. The attacker does not need to win a race or satisfy special prerequisites.
PR:L, Privileges Required: Low. The attacker must hold some privileges, but only low ones. In a WordPress context this reads as: any authenticated account with minimal privileges suffices. Sites with open registration present a larger attack surface for this class of issue, because registration itself hands the attacker the required foothold.
UI:N, User Interaction: None. No victim needs to click, approve, or be tricked. The attacker drives the entire request flow from their own account.
S:U, Scope: Unchanged. Exploitation stays within the vulnerable component's own security scope; the score does not imply impact propagating into other parts of the system.
C:L/I:L/A:N, Confidentiality: Low, Integrity: Low, Availability: None. The attacker gains limited read access to data they should not see and limited ability to modify data they should not control. There is no availability impact: the flaw provides no path to denial of service.

Read together, the vector describes a quiet, authenticated, low-privilege attack: log in with a minimal account, send requests that reference objects the account does not own, and read or alter a bounded amount of data. The score implies no privilege escalation to administrator roles and no code execution. The severity ceiling is set by the low confidentiality and integrity ratings, which is typical for object-level authorization bugs whose blast radius is confined to specific data objects. Which data objects are reachable through this flaw is not fully disclosed in the provided data.

Affected Software and Versions

The affected product is SmartCrawl, an SEO plugin for WordPress published by WPMU DEV, distributed under the plugin slug smartcrawl-seo.

Product: SmartCrawl (smartcrawl-seo) for WordPress, by WPMU DEV.
Affected versions: from n/a through 3.16.4. In NVD version-range syntax this means every released version of the plugin up to and including 3.16.4 is affected; there is no lower bound, so all historical versions fall inside the range.
Fixed version: the provided advisory data does not name a patched release. Administrators should treat any version at or below 3.16.4 as vulnerable and move to the first available release above 3.16.4 once the vendor changelog confirms the fix.
KEV status: CVE-2026-110901 is not listed in CISA's Known Exploited Vulnerabilities catalog.

Because the range has no lower bound, version triage is straightforward: if the installed SmartCrawl version is 3.16.4 or older, the site is within the affected range. The version can be read from the Plugins screen in wp-admin, or from the Version field in the plugin header inside wp-content/plugins/smartcrawl-seo/.

Impact

The scored impact is confined to confidentiality and integrity, both at low magnitude, with no availability component:

Confidentiality: Low. The attacker can read some data the account should not be able to access. The rating indicates bounded disclosure of protected objects, not bulk extraction of highly sensitive material such as credentials or full database contents.
Integrity: Low. The attacker can modify some data they should not control. Modification is possible but limited in scope or consequence.
Availability: None. The vulnerability does not enable denial of service, crashes, or resource exhaustion.

The advisory's impact phrasing, Exploiting Incorrectly Configured Access Control Security Levels, frames the consequence as an access control failure rather than a memory corruption or injection problem. Nothing in the provided data indicates remote code execution, escalation to higher WordPress roles, or malware delivery. The practical risk for a site owner is unauthorized cross-object read and write access by a low-privileged account, which still matters in multi-user environments: content, settings, or records belonging to one user or managed by one role may be exposed to or altered by another. Which specific objects are reachable is not fully disclosed in the provided sources.

Exploitation Scenario

The following scenario is illustrative and hypothetical. It is derived from the CWE-639 classification, the CVSS vector, and the advisory description. The specific endpoint, parameter names, and object types in SmartCrawl are not fully disclosed in the provided sources, so the scenario describes the general CWE-639 pattern rather than a verified request sequence.

Consider a WordPress site running SmartCrawl at or below version 3.16.4 with registration open to visitors. An attacker creates a standard low-privileged account, satisfying the PR:L requirement of the CVSS vector. While using the site as an ordinary authenticated user, the attacker identifies a plugin-driven request that accepts a user-controlled key, an identifier selecting which object the request operates on. Because the access control behind that request is incorrectly configured, the server validates that the request is authenticated but does not verify that the authenticated user is authorized to act on the referenced object.

The attacker substitutes identifiers belonging to other users or to objects outside their permitted scope. The server processes each request against the substituted key and returns or updates the targeted object. Repeating this across a range of identifier values yields limited unauthorized reads (C:L) and limited unauthorized modifications (I:L) without any victim action (UI:N), without elevated privileges (PR:L), and without disrupting the service (A:N). This is the canonical authorization bypass through a user-controlled key: the identifier, not the permission model, decides what the request touches.

Detection and Mitigation

Detection. Defenders can take the following steps, derived from the affected range and the nature of the weakness:

Determine the installed version. Check the Plugins screen in wp-admin or the plugin header file. Any version from n/a through 3.16.4 is affected.
Review accounts. Exploitation requires a low-privileged authenticated account, so audit recently registered or dormant accounts on affected sites, particularly where open registration is enabled.
Review logs for identifier manipulation. For CWE-639 patterns, defenders look for authenticated requests from a single account that iterate over changing object identifiers, or for access by one account to objects associated with another. The provided data does not disclose request signatures specific to this flaw, so log review should target the general pattern.

Mitigation.

Update the plugin. The provided data does not name a fixed version, but the affected range ends at 3.16.4. Updating SmartCrawl to the first release above 3.16.4, after confirming the fix in the vendor changelog, removes the affected code from the site.
Reduce the prerequisite. Until the update is applied, closing open registration and pruning unnecessary low-privileged accounts raises the bar, because PR:L means the attacker must hold a valid low-privilege account.
Apply object-level authorization hardening. For custom integrations and in-house code, ensure every endpoint that accepts an object identifier verifies the requester's authorization over that specific object, independent of authentication state.

There is no indication in the provided data of active exploitation, and the CVE is not in the CISA KEV catalog, but neither fact reduces the urgency of patching: the affected range covers every version of the plugin up to and including 3.16.4.

Bug Bounty Angle

For bug bounty hunters, CVE-2026-110901 is a textbook example of why object-level authorization testing belongs in every WordPress plugin assessment, and of how such findings become assigned CVEs. The issue was discovered by AndrewN through the Patchstack Bug Bounty Program, with the CVE identifier assigned by Patchstack, showing that IDOR-class bugs in WordPress plugins are triaged, credited, and published through that channel.

Methodology pointers for the CWE-639 class, applicable wherever you hold authorization to test:

Enumerate authenticated surfaces first. Log in with the lowest-privileged account available and map every request the application issues, since PR:L-classified bugs are reachable from minimal accounts.
Identify user-controlled keys. Look for identifiers in query strings, request bodies, and API payloads that select an object. Numeric, sequential, or guessable identifiers are prime candidates.
Swap and compare. Replace the identifier with one referencing an object your account does not own, keep the session constant, and compare responses. A response that leaks or modifies another user's object is the finding.
Test read and write paths separately. The C:L and I:L ratings in this CVE's vector indicate that both unauthorized retrieval and unauthorized modification were scored; in similar findings, verify each direction independently.
Characterize the access control gap. Determine whether the check is absent or merely configured at the wrong level, matching the advisory's Incorrectly Configured Access Control Security Levels characterization. That distinction affects severity and the quality of the eventual fix.

When reporting a CWE-639 finding, name the weakness explicitly, provide the minimal request pair (your own object versus a foreign object), and state the affected version range precisely, as the NVD entry does for SmartCrawl: from n/a through 3.16.4.

Frequently Asked Questions

What is CVE-2026-110901?

A medium-severity (CVSS 5.4) Authorization Bypass Through User-Controlled Key vulnerability, classified as CWE-639, in the WPMU DEV SmartCrawl WordPress SEO plugin (smartcrawl-seo), affecting all versions through 3.16.4.

Which SmartCrawl versions are affected?

All versions from n/a through 3.16.4. The provided advisory data does not name a fixed release; site owners should update to the first version above 3.16.4 after confirming the fix with the vendor.

What does the CVSS 5.4 score mean for this CVE?

It is remotely exploitable over a network by a low-privileged authenticated user, with low attack complexity and no user interaction, causing low confidentiality and integrity impact and no availability impact.

Is CVE-2026-110901 being exploited in the wild?

The provided data shows no evidence of exploitation, and the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Discovery and Credits: Credited to AndrewN via the Patchstack Bug Bounty Program; the CVE identifier was assigned by Patchstack.