PT-2026-51681 · Ailchev · Searchplus

Abhirup Konwar · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-8617

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus save token action callback() and searchplus reset token action callback() functions, both of which are exposed to unauthenticated users through the wp ajax nopriv hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin's stored account token and account name options (dym token, dym name, searchplus token, searchplus name, sp token, sp name).

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-8617

Affected Products

Searchplus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-8617 · Security Note
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L57 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b1800f37-f9ab-454b-84f7-4d5eb5ed3acf?source=cve · Note
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L45 · Note
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L39 · Note
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L24 · Note