WordPress · Searchwp Live Ajax Search · CVE-2022-2535
**Name of the Vulnerable Software and Affected Versions**
SearchWP Live Ajax Search WordPress plugin versions prior to 1.6.2
**Description**
The issue allows unauthenticated users to make a crafted query, disclosing private, draft, and pending post titles along with their permalinks, because it does not limit live search results to published posts only.
**Recommendations**
For versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the live search functionality until the update is applied.