CVE-2022-2535CWE-639

SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure

published August 15, 2022

CVSS
—
EPSS
2%
Percentile
80.9
In the wild
Unconfirmed
What it is

The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02037 · 80.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-08-15T08:38Z
EPSS history
Timeline
  • 15 AUG 08:38Z
    SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
    cvelistv5