Unauthorized Access to Password Protected Posts via Search Query

CVE-2024-7630

Summary

The Relevanssi – A Better Search plugin for WordPress has a vulnerability that allows for information exposure due to insufficient query limitations in the relevanssi_do_query() function. This flaw affects all versions up to and including 4.22.2, enabling unauthenticated attackers to extract potentially sensitive information from posts that are typically password protected. Organizations using this plugin should assess their exposure and implement necessary safeguards to mitigate unauthorized data access.

References