What is the severity of CVE-2025-2821?

CVE-2025-2821 has a medium severity rating due to the potential for unauthorized data modification.

How do I fix CVE-2025-2821?

To fix CVE-2025-2821, update the Search Exclude plugin for WordPress to version 2.5.0 or higher.

Who is affected by CVE-2025-2821?

CVE-2025-2821 affects all versions of the Search Exclude plugin for WordPress up to and including 2.4.9.

What does CVE-2025-2821 allow an attacker to do?

CVE-2025-2821 allows unauthenticated attackers to modify plugin settings due to a missing capability check.

Is any action required if I am using an updated version of the plugin in relation to CVE-2025-2821?

If you are using an updated version of the Search Exclude plugin (2.5.0 or higher), no action is required regarding CVE-2025-2821.

Vulnerability/
CVE-2025-2821

medium

5.3

CWE

862

7/5/2025

CVE-2025-2821: Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification

First published: Wed May 07 2025(Updated: )

The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results.

Credit: security@wordfence.com

Affected Software	Affected Version	How to fix
WordPress Search Exclude	<=2.4.9

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2025-2821?
CVE-2025-2821 has a medium severity rating due to the potential for unauthorized data modification.
How do I fix CVE-2025-2821?
To fix CVE-2025-2821, update the Search Exclude plugin for WordPress to version 2.5.0 or higher.
Who is affected by CVE-2025-2821?
CVE-2025-2821 affects all versions of the Search Exclude plugin for WordPress up to and including 2.4.9.
What does CVE-2025-2821 allow an attacker to do?
CVE-2025-2821 allows unauthenticated attackers to modify plugin settings due to a missing capability check.
Is any action required if I am using an updated version of the plugin in relation to CVE-2025-2821?
If you are using an updated version of the Search Exclude plugin (2.5.0 or higher), no action is required regarding CVE-2025-2821.

collector/mitre-cve
source/MITRE
agent/title
agent/weakness
agent/description
agent/references
agent/type
agent/first-publish-date
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
agent/softwarecombine
collector/nvd-api
source/NVD
agent/severity
agent/last-modified-date
agent/author
agent/tags
agent/source
agent/event
vendor/wordpress
canonical/wordpress search exclude

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.