CVE-2026-110901: Authorization Bypass Through User-Controlled Key in WPMU DEV SmartCrawl

The vulnerability CVE-2026-110901 in WPMU DEV SmartCrawl SEO plugin arises from incorrect access control configurations that permit authorization bypass via a user-controlled key. This flaw allows an attacker with low privileges to gain unauthorized access to certain functionalities or data by exploiting the misconfiguration. The affected versions include all releases prior to 3.17.1, specifically from the initial versions up to 3.16.4. The CVSS v3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity impacts are low, with no availability impact reported.

An attacker with low privileges can bypass authorization controls by manipulating a user-controlled key due to misconfigured access control security levels. This could lead to unauthorized access to restricted features or data within the SmartCrawl plugin. The impact is limited to confidentiality and integrity with low severity, and no availability impact is noted.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in SmartCrawl to prevent unauthorized key manipulation. Monitor vendor communications for updates and apply patches promptly once available.