Executive brief
The Search Simple Fields plugin for WordPress, which helps manage how custom data is searched on a website, contains a security flaw that could allow an attacker to change its settings. By tricking a site administrator into clicking a malicious link or visiting a compromised page, an attacker can remotely modify which content types and custom fields are searchable. This could disrupt site search functionality or lead to unauthorized changes in how media and data are handled by the plugin.
Technical details
The Search Simple Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the search_simple_fields_options() function within the functions_admin.php file. This vulnerability affects versions up to and including 0.2. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which triggers a forged request. Successful exploitation allows the attacker to modify plugin settings, including searchable post types, custom fields, media fields, and the custom media function name. This is a classic CWE-352 flaw where the application fails to verify that a sensitive request was intentionally initiated by the user.
Affected products
- WordPress Search Simple Fields up to, and including, 0.2
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory