CVE-2022-2535

SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure

State: Published
Severity: Not scored
Published: Aug 15, 2022
Updated: Aug 3, 2024
Reserved: Jul 25, 2022

Description

The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink

Scores

The record has no CVSS score.

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
SearchWP Live Ajax SearchUnknown	1.6.2 to before 1.6.2Affected

References

https://wpscan.com/vulnerability/0e13c375-044c-4c2e-ab8e-48cb89d90d02

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.