The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress contains an improper access control vulnerability (CWE-284) due to a missing capability check in the update_submodule() function. This flaw enables authenticated attackers with low-level privileges (Subscriber and above) to update the plugin's settings, potentially altering its configuration without proper authorization. The vulnerability affects all versions up to 3.14.3. The CVSS v3.1 base score is 4.3, indicating medium severity. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

An attacker with Subscriber-level access or higher can modify the plugin's settings without proper authorization. This could lead to unauthorized changes in SEO configurations managed by the plugin. There is no indication of confidentiality or availability impact, only integrity impact is noted. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users.