CVE-2022-2535

Medium

Description

The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink

SeverityMedium

CVSS5.3

Exploit probability—

ProductSearchwp Live Ajax Search

PublishedAug 15, 2022

First seenAug 15, 2022

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

searchwp searchwp_live_ajax_search1.6.2 or later

Affected products

Product	Affected versions	Fixed in
searchwp searchwp_live_ajax_search	v < 1.6.2	1.6.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.