CVE-2026-16979— SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | SmartCrawl SEO checker, analyzer & optimizer | < 3.16.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16979
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
Source: CVE Program / CVE List V5
Vulnerability Description
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | SmartCrawl SEO checker, analyzer & optimizer | 0 ~ 3.16.3 | - |
II. Public POCs for CVE-2026-16979
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16979
请登录查看更多情报信息。
News Coverage for CVE-2026-16979 (1)
Same Patch Batch · Unknown · 2026-08-19 · 38 CVEs total
| CVE-2026-18779 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record De | |
| CVE-2026-17565 | Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery | |
| CVE-2026-18466 | WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation | |
| CVE-2026-18051 | W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Ove | |
| CVE-2026-18231 | WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user | |
| CVE-2026-18202 | JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-18776 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJA | |
| CVE-2026-18778 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multi | |
| CVE-2026-18777 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Chan | |
| CVE-2026-18937 | Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection | |
| CVE-2026-18031 | TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback | |
| CVE-2026-19055 | ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters | |
| CVE-2026-19709 | Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consu | |
| CVE-2026-19056 | ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter | |
| CVE-2026-19416 | KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR | |
| CVE-2026-19406 | Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appoint | |
| CVE-2026-19417 | KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR | |
| CVE-2026-19782 | WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users | |
| CVE-2026-19842 | SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SA | |
| CVE-2026-14334 | Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SV |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-77001
Social Login & Sharing buttons with Analytics By SoClever <= - CVE-2026-77002
SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentica - CVE-2026-77000
WP Social Media Login <= 1.0.6 - Unauthenticated Account Tak - CVE-2026-19222
Forminator Forms < 1.57.0.7 - Authenticated Privilege Escala - CVE-2026-19093
Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Vide
V. Comments for CVE-2026-16979
No comments yet