PT-2026-51681 · Ailchev · Searchplus

Abhirup Konwar · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-8617

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus save token action callback() and searchplus reset token action callback() functions, both of which are exposed to unauthenticated users through the wp ajax nopriv hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin's stored account token and account name options (dym token, dym name, searchplus token, searchplus name, sp token, sp name).

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-8617

Produtos afetados

Searchplus

Referências · 5

• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L45 · Nota
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L24 · Nota
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L57 · Nota
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L39 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b1800f37-f9ab-454b-84f7-4d5eb5ed3acf?source=cve · Nota