CVE-2026-59520 is a Cross-Site Request Forgery (CWE-352) vulnerability in the CrawlWP SEO plugin by properfraction. It affects versions up to 3.0.16 inclusive. The vulnerability allows attackers to induce authenticated users to perform unintended actions via crafted requests. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, and impacts integrity with no confidentiality or availability impact. No vendor advisory or patch information is currently available.

An attacker could exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user by leveraging CSRF techniques. This could lead to integrity issues within the affected application, such as unauthorized changes to SEO settings or configurations. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing standard CSRF mitigations such as verifying request origins, using anti-CSRF tokens, or restricting access to trusted users only. Monitor official vendor channels for updates.