Unauthorized Schema Injection Vulnerability in SmartCrawl WordPress SEO Plugin

CVE-2024-3287

What is CVE-2024-3287?

The SmartCrawl SEO plugin for WordPress is susceptible to unauthorized ld+json description injection due to inadequate capability checks in the save_settings function. This vulnerability affects all versions up to and including 3.10.2, allowing unauthenticated attackers to manipulate schema types. Exploitation of this flaw can lead to misleading search engine results and potential SEO degradation for affected websites, posing significant risks to site owners and users.

References