CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject arbitrary arguments into a WP_Query query and potentially expose sensitive information such as attachments or private posts.
Explanation of Vulnerability in Simple Terms
Relevanssi Live Ajax Search versions 2.4 and earlier leak sensitive information through search functionality. An unauthenticated attacker can read partial data without user interaction. The vulnerability affects the search component's information disclosure handling. Update to a version newer than 2.4.
What an attacker can do
Read sensitive information from the site's search index without authentication.
Potential impact on your site
Visitor search queries and indexed content may be exposed to unauthenticated users.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
