CVE-2025-26876 MEDIUM

CVE-2025-26876: WordPress Search with Typesense Plugin <= 2.0.8 - Path Traversal vulnerability

Vendor Codemanas

Product Search with Typesense

Weakness CWE-35

Published February 25, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.8/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.

Explanation of Vulnerability in Simple Terms

02Summary

Search with Typesense versions 2.0.8 and earlier contain a denial-of-service vulnerability affecting availability. An attacker with high-level privileges can trigger a condition that disrupts service across the application. The vulnerability requires administrative or elevated account access to exploit. Update to a version newer than 2.0.8.

What an attacker can do

03Attacker Capabilities

Disrupt service availability for all users of the site.

Potential impact on your site

04Site Impact

Site administrators with elevated privileges could accidentally or maliciously cause service outages affecting all users.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative or privileged account access.

Key dates

06Disclosure timeline

February 25, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-26876 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/35.html AskarLabs — CWE-35 write-up Path Traversal (Multiple Leading Dots)

Related vulnerabilities