CVE-2022-2535
First published: Mon Aug 15 2022(Updated: )
The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Searchwp Searchwp Live Ajax Search | <1.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-2535.
What is the severity level of CVE-2022-2535?
The severity level of CVE-2022-2535 is medium with a severity value of 5.3.
What is the affected software for CVE-2022-2535?
The affected software for CVE-2022-2535 is the SearchWP Live Ajax Search WordPress plugin before version 1.6.2.
What is the impact of CVE-2022-2535?
The impact of CVE-2022-2535 is that unauthenticated users can make a crafted query and disclose private/draft/pending post titles along with their permalinks.
How can I fix CVE-2022-2535?
To fix CVE-2022-2535, update the SearchWP Live Ajax Search WordPress plugin to version 1.6.2 or later.
- collector/nvd-index
- vendor/searchwp
- canonical/searchwp searchwp live ajax search