CVE-2025-2821 MEDIUM

CVE-2025-2821: Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification

Vendor Quadlayers

Product Search Exclude

Weakness CWE-862 · Missing authorization

Published May 7, 2025

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results.

Key dates

02Disclosure timeline

May 7, 2025 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-2821 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-62932 WordPress Table Block by RioVizual plugin <= 3.0.0 - Broken Access Control vulnerability CVE-2025-46811 SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint CVE-2025-68994 WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability CVE-2024-35723 WordPress Dashboard To-Do List plugin <= 1.2.0 - Broken Access Control vulnerability CVE-2025-62953 WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability