CVE-2026-8617: SearchPlus WordPress Plugin Unauthenticated Token Deletion Vulnerability

Technical summary

CVE-2026-8617 is a missing authentication and authorization vulnerability in the SearchPlus WordPress plugin. The functions searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() are registered via wp_ajax_nopriv_ hooks, which intentionally expose them to unauthenticated users. However, these functions lack both capability checks (current_user_can() validation) and nonce verification, allowing unauthenticated attackers to invoke them via AJAX requests. The vulnerability permits unauthorized modification or deletion of six option keys: dym_token, dym_name, searchplus_token, searchplus_name, sp_token, and sp_name. The CVSS v3.1 score of 5.3 reflects low integrity impact with network-based attack vector and no privileges or user interaction required.

Business impact

If your organization uses SearchPlus for site search functionality, this vulnerability could disrupt service by allowing an attacker to invalidate account credentials stored in the plugin. Legitimate search operations would fail until tokens are re-configured. While direct data exfiltration is not possible (the vulnerability does not expose confidential information), the ability to sabotage plugin configuration creates operational risk and may trigger emergency remediation work. The impact is contained to SearchPlus functionality and does not affect WordPress core or other plugins, limiting lateral blast radius.

Affected systems

WordPress installations with the SearchPlus plugin active in versions 1.7.1 and earlier are affected. The vulnerability requires no specific WordPress configuration or additional plugins; it exists whenever SearchPlus is installed and enabled. Multisite WordPress instances are also at risk. The vulnerability does not require authentication, so it affects all sites running vulnerable versions regardless of access controls or user roles.

Exploitability

This vulnerability is straightforward to exploit. An attacker needs only to craft HTTP requests to the WordPress AJAX endpoint with the appropriate action parameter and option values. No authentication credentials are required, no user interaction is necessary, and exploitation works over the network from any location. No special tools beyond a basic HTTP client are needed. However, the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog as of the latest update, suggesting limited in-the-wild activity at this time.

Remediation

Update the SearchPlus plugin to a version that addresses this vulnerability. Verify with the plugin vendor's security advisory for the specific patched version number. If an immediate patch is unavailable, consider temporarily disabling the SearchPlus plugin and using WordPress's native search or an alternative plugin until a fix is released. After patching, verify that account tokens have not been maliciously altered by checking the plugin's configuration settings.

Patch guidance

Consult the official SearchPlus plugin security advisory or the WordPress plugin repository listing for the patched version number and apply it as soon as testing allows. Most WordPress sites can be updated directly from the WordPress admin dashboard under Plugins > Installed Plugins. After updating, confirm the plugin's token configuration remains intact. If tokens were cleared by an attacker, you may need to re-enter account credentials in the plugin settings.

Detection guidance

Monitor WordPress AJAX logs for repeated requests to wp-admin/admin-ajax.php with action=searchplus_save_token_action_callback or action=searchplus_reset_token_action_callback originating from unexpected IP addresses or patterns. Log analysis of option updates (wp_options table modifications) to dym_token, dym_name, searchplus_token, searchplus_name, sp_token, or sp_name may reveal unauthorized changes. Web Application Firewalls can be configured to flag or block AJAX requests to these actions from unauthenticated sources. Check plugin activity logs if SearchPlus includes detailed logging functionality.

Why prioritize this

While this vulnerability carries a MEDIUM severity score, its trivial exploitability and zero authentication barrier warrant prompt attention. The risk is further amplified by the fact that SearchPlus installations are typically public-facing and discoverable. Unlike high-severity vulnerabilities requiring complex exploitation chains, this flaw can be weaponized in minutes by any attacker. Organizations should treat this as a near-term patching priority, not a defer-until-next-cycle item, given the simplicity of both attack and remediation.

Risk score, explained

The CVSS 5.3 MEDIUM rating reflects the vulnerability's network attack vector (AV:N), low attack complexity (AC:L), and lack of privilege or user interaction requirements (PR:N, UI:N). However, the impact is limited to integrity of plugin configuration data (I:L) with no confidentiality or availability loss in the CVSS model. The integrity impact is noteworthy because it allows sabotage of account credentials, even if those credentials themselves are not disclosed. Organizations with critical reliance on SearchPlus functionality should weight the operational impact above the numerical score.

Frequently asked questions