Executive brief
The SearchPlus plugin for WordPress, which provides enhanced search functionality, contains a security flaw that allows unauthorized users to modify its settings. An attacker can remotely overwrite or delete the plugin's account tokens and configuration names without needing a password. This could disrupt the search service on the website and disconnect the site from the SearchPlus account.
Technical details
The SearchPlus plugin for WordPress is vulnerable to unauthorized data modification due to missing capability checks and missing nonce validation in the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions. These functions are improperly exposed to unauthenticated users via the wp_ajax_nopriv_ hooks. A remote, unauthenticated attacker can exploit this to overwrite or delete sensitive plugin options, including account tokens (dym_token, searchplus_token, sp_token) and account names (dym_name, searchplus_name, sp_name). This vulnerability affects all versions up to and including 1.7.1.
Affected products
- ailchev SearchPlus <= 1.7.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php
- https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php
- https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php
- https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b1800f37-f9ab-454b-84f7-4d5eb5ed3acf?source=cve