Search Go CVE-2026-24971

Remote unauthenticated attacker can exploit Elated-Themes Search & Go plugin versions <= 2.8 with default WordPress configuration. No user interaction required. Vulnerability stems from incorrect privilege assignment in plugin code allowing unauthorized privilege escalation.

The real-world risk assessment presents mixed signals. Positively, the attack vector appears to require some level of user interaction or authenticated access (typical of WordPress privilege escalation flaws), and there is no publicly disclosed EPSS score or CVE-CVSS vector, suggesting either limited public exploit availability or incomplete disclosure. However, privilege escalation vulnerabilities in WordPress themes are highly practical to exploit and frequently abused in the wild, as WordPress sites are widely deployed and often inadequately maintained. The vulnerability has been formally tracked by ENISA (EUVD-2026-15582) and documented by established security vendor Patchstack, indicating credibility and likely operational awareness in exploit communities. Without CVSS base score or KEV status confirmation, the prioritization should be moderate-to-high for WordPress site administrators running Search & Go, particularly those with public user registration enabled. This is a legitimate priority for affected organizations despite the absence of a CVSS vector.

An attacker registers a low-privilege WordPress account (subscriber) on a website using the vulnerable Search & Go theme. The attacker then discovers that the theme fails to properly validate user capabilities before executing certain administrative functions, such as modifying site settings or accessing plugin management. By directly navigating to or crafting requests to these unprotected endpoints, the attacker escalates their account to administrator-level access without requiring the actual administrative credentials. Once elevated, the attacker can install malicious plugins, modify site content, steal data, or pivot to compromise the underlying server.