What is the CVSS score of CVE-2026-8617?

CVE-2026-8617 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

SearchPlus WordPress Plugin CVE-2026-8617

EUVD-2026-38674 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-hrxf-7cvc-wf78

WordPress Authentication Bypass Wordpress Plugin Searchplus

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

wp_ajax_nopriv_ requires no authentication or user interaction; impact limited to integrity of plugin options with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 07:02 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions, both of which are exposed to unauthenticated users through the wp_ajax_nopriv_ hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin's stored account token and account name options (dym_token, dym_name, searchplus_token, searchplus_name, sp_token, sp_name).

AnalysisAI

Unauthenticated token manipulation in the SearchPlus WordPress plugin (versions up to and including 1.7.1) allows any remote visitor to overwrite or delete the plugin's stored API credentials by invoking two unprotected AJAX callbacks. Both searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() are registered via wp_ajax_nopriv_ hooks and lack both capability checks and nonce validation, making them freely accessible without authentication. No public exploit or active exploitation has been identified at time of analysis, and real-world impact is limited to disruption of the plugin's search functionality or substitution of attacker-controlled account tokens.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization). WordPress's wp_ajax_nopriv_ hook registration mechanism is designed for AJAX handlers that serve unauthenticated users, but it places the full burden of access control on the plugin developer. Both affected functions - searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() - omit current_user_can() capability checks and nonce validation, the two standard WordPress defenses against unauthorized AJAX invocation. The plugin integrates with an external search-as-a-service API and stores multiple credential pairs: dym_token, dym_name, searchplus_token, searchplus_name, sp_token, and sp_name as WordPress options. The vulnerable code paths are confirmed visible in the plugin's Trac repository at functions.php lines 24, 39, 45, and 57. The affected CPE is cpe:2.3:a:ailchev:searchplus:*:*:*:*:*:*:*:*, covering all releases through 1.7.1.

RemediationAI

No vendor-released patched version is confirmed in the available data - the advisory covers all versions through 1.7.1 with no fixed release cited, so administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b1800f37-f9ab-454b-84f7-4d5eb5ed3acf for a remediated release. The most effective immediate compensating control is to deactivate the SearchPlus plugin entirely, which removes the exposed wp_ajax_nopriv_ endpoints from the attack surface at the cost of losing site search functionality. If deactivation is not feasible, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php where the action parameter matches the plugin's registered AJAX action names will prevent exploitation, though the exact action names should be confirmed from the plugin source before deployment to avoid breaking other AJAX-dependent features. Wordfence users with the premium firewall may receive automatic protection rules prior to plugin patch availability.