CVE-2026-8617
Received Received - Intake
Unauthenticated Data Modification in SearchPlus WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: Wordfence

Description
The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions, both of which are exposed to unauthenticated users through the wp_ajax_nopriv_ hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin's stored account token and account name options (dym_token, dym_name, searchplus_token, searchplus_name, sp_token, sp_name).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-24
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-8617
EUVD
EUVD-2026-38674
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
searchplus plugin to 1.7.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The SearchPlus plugin for WordPress, in versions up to and including 1.7.1, has a vulnerability that allows unauthorized users to modify or delete data. This happens because the plugin lacks proper capability checks and nonce validation in two specific functions: searchplus_save_token_action_callback() and searchplus_reset_token_action_callback(). These functions are accessible to unauthenticated users via the wp_ajax_nopriv_ hooks, enabling attackers to overwrite or delete stored account tokens and account name options.

Impact Analysis

This vulnerability can allow unauthenticated attackers to overwrite or delete important plugin data such as account tokens and account names. While it does not directly compromise confidentiality or availability, it can lead to integrity issues by allowing attackers to alter stored data, potentially disrupting plugin functionality or causing loss of configuration.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart