SearchWP [searchwp] < 4.2.6
unknown[en] Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
- Affected:
- up to 4.2.6
- Fixed in:
- 4.2.6
- Disclosed:
- Nov 8, 2022
plugin
2 known security issues reported for the Searchwp WordPress plugin. Most recent disclosed Nov 8, 2022.
Running Searchwp on your site? Check whether your installed version is affected.
Scan your site free[en] Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
The SearchWP Premium plugin for WordPress is vulnerable to authorization bypass due to leaking a nonce protecting a function used to modify plugin settings in versions up to, and including, 4.2.5. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to obtain the nonce and mo...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free