PT-2025-39960 · WordPress · Smartcrawl Seo

Rafshanzani Suhada · Published 2025-09-30 · Updated 2025-09-30 · CVE-2025-11163

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SmartCrawl SEO plugin for WordPress versions prior to 3.14.4

Description The SmartCrawl SEO plugin for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check within the update submodule() function. Authenticated attackers with Subscriber-level access or higher can update the plugin’s settings.

Recommendations Update the SmartCrawl SEO plugin to version 3.14.4 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-11163

Affected Products

Smartcrawl Seo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11163 · Security Note
• https://twitter.com/CVEnew/status/1972901861024739661 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3366486/smartcrawl-seo/trunk/includes/core/controllers/class-submodule-controller.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8a63a9b3-c056-45f3-952c-9aee997d1d27?source=cve · Note
• https://t.me/CVEtracker/33702 · Telegram Post
• https://plugins.trac.wordpress.org/browser/smartcrawl-seo/tags/3.14.2/includes/core/controllers/class-submodule-controller.php#L123 · Note