CVE-2026-8617

Deferred Deferred - Pending Action

Unauthenticated Data Modification in SearchPlus WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-25

Assigner: Wordfence

Description

The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions, both of which are exposed to unauthenticated users through the wp_ajax_nopriv_ hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin's stored account token and account name options (dym_token, dym_name, searchplus_token, searchplus_name, sp_token, sp_name).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-25

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-8617

EUVD

EUVD-2026-38674

Affected Vendors & Products

Vendor	Product	Version / Range
searchplus	plugin	to 1.7.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The SearchPlus plugin for WordPress, in versions up to and including 1.7.1, has a vulnerability that allows unauthorized users to modify or delete data. This happens because the plugin lacks proper capability checks and nonce validation in two specific functions: searchplus_save_token_action_callback() and searchplus_reset_token_action_callback(). These functions are accessible to unauthenticated users via the wp_ajax_nopriv_ hooks, enabling attackers to overwrite or delete stored account tokens and account name options.

Impact Analysis

This vulnerability can allow unauthenticated attackers to overwrite or delete important plugin data such as account tokens and account names. While it does not directly compromise confidentiality or availability, it can lead to integrity issues by allowing attackers to alter stored data, potentially disrupting plugin functionality or causing loss of configuration.

Compliance Impact

The vulnerability allows unauthenticated attackers to modify or delete stored account tokens and names in the SearchPlus WordPress plugin due to missing capability checks and nonce validation.

However, there is no specific information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-8617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70