Is CVE-2026-59520 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59520 being exploited in the wild.

How severe is CVE-2026-59520?

Medium severity, with a CVSS score of 4.3, published 5 July 2026.

Which products and versions are affected?

Properfraction CrawlWP SEO (Index Now) n/a through 3.0.16.

Is there a fix for CVE-2026-59520?

A patch was published on 2026-07-05: Patch released in version 3.0.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59520 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59520?

Check whether you run Properfraction CrawlWP SEO (Index Now) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59520: properfraction CrawlWP SEO CSRF in Index Now plugin

CVE-2026-59520 · Severity: medium · CVSS 4.3 · Published 2026-07-05

CrawlWP SEO (also known as Index Now) is a WordPress plugin used to help search engines index website content more efficiently. A security flaw in this plugin could allow an attacker to trick a site administrator into performing unintended configuration changes or actions. This occurs if the administrator clicks on a malicious link or visits a specially crafted webpage while logged into their WordPress site.

Vendors: Properfraction.

Quick answers

Is CVE-2026-59520 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59520 being exploited in the wild.
How severe is CVE-2026-59520?: Medium severity, with a CVSS score of 4.3, published 5 July 2026.
Which products and versions are affected?: Properfraction CrawlWP SEO (Index Now) n/a through 3.0.16.
Is there a fix for CVE-2026-59520?: A patch was published on 2026-07-05: Patch released in version 3.0.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59520 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59520?: Check whether you run Properfraction CrawlWP SEO (Index Now) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the properfraction CrawlWP SEO plugin (also known as Index Now) for WordPress in versions up to and including 3.0.16. The vulnerability stems from a lack of proper nonce validation on sensitive plugin actions. An unauthenticated remote attacker can exploit this by tricking a privileged user (such as an administrator) into clicking a malicious link or submitting a crafted form. Successful exploitation allows the attacker to perform unauthorized actions or change plugin settings on behalf of the authenticated user. The issue is resolved in version 3.0.17.

Affected products

properfraction CrawlWP SEO (Index Now) n/a through 3.0.16

Timeline

2026-06-30: other: Reported by researcher Ananda Dhakal
2026-07-05: disclosed: Early warning sent to Patchstack customers
2026-07-05: advisory: Public advisory published by Patchstack and NVD
2026-07-05: patched: Patch released in version 3.0.17

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.