# CVE-2026-59520: properfraction CrawlWP SEO CSRF in Index Now plugin

Source: https://junglewise.ai/threats/cve-2026-59520-properfraction-crawlwp-seo-csrf-in-index-now-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-59520 · Severity: medium · CVSS 4.3 · Published 2026-07-05

CrawlWP SEO (also known as Index Now) is a WordPress plugin used to help search engines index website content more efficiently. A security flaw in this plugin could allow an attacker to trick a site administrator into performing unintended configuration changes or actions. This occurs if the administrator clicks on a malicious link or visits a specially crafted webpage while logged into their WordPress site.

Vendors: [Properfraction](https://junglewise.ai/threats/vendors/properfraction).

## Quick answers

**Is CVE-2026-59520 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59520 being exploited in the wild.

**How severe is CVE-2026-59520?** Medium severity, with a CVSS score of 4.3, published 5 July 2026.

**Which products and versions are affected?** Properfraction CrawlWP SEO (Index Now) n/a through 3.0.16.

**Is there a fix for CVE-2026-59520?** A patch was published on 2026-07-05: Patch released in version 3.0.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59520 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59520?** Check whether you run Properfraction CrawlWP SEO (Index Now) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the properfraction CrawlWP SEO plugin (also known as Index Now) for WordPress in versions up to and including 3.0.16. The vulnerability stems from a lack of proper nonce validation on sensitive plugin actions. An unauthenticated remote attacker can exploit this by tricking a privileged user (such as an administrator) into clicking a malicious link or submitting a crafted form. Successful exploitation allows the attacker to perform unauthorized actions or change plugin settings on behalf of the authenticated user. The issue is resolved in version 3.0.17.

## Affected products

- properfraction CrawlWP SEO (Index Now) n/a through 3.0.16

## Timeline

- 2026-06-30: other: Reported by researcher Ananda Dhakal
- 2026-07-05: disclosed: Early warning sent to Patchstack customers
- 2026-07-05: advisory: Public advisory published by Patchstack and NVD
- 2026-07-05: patched: Patch released in version 3.0.17

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/mihdan-index-now/vulnerability/wordpress-index-now-plugin-3-0-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/mihdan-index-now/vulnerability/wordpress-index-now-plugin-3-0-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)