The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin versions prior to 3.16.3 do not perform capability checks on two AJAX actions. This lack of authorization validation allows users with Subscriber-level privileges to access titles of private and draft posts by their IDs and to enumerate post-meta key names stored in the system. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or patch information is currently available, and no known exploits are reported in the wild.

Users with minimal privileges (Subscriber role) can access information that should be restricted, such as titles of private and draft posts and metadata keys. This could lead to unauthorized disclosure of sensitive content or internal metadata structure, potentially aiding further attacks or information gathering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber role capabilities if possible or disable the affected AJAX actions to prevent unauthorized access.