Unauthorized Data Modification in Search Exclude Plugin for WordPress

CVE-2025-10646

What is CVE-2025-10646?

The Search Exclude plugin for WordPress has a critical flaw that allows authenticated attackers with Contributor-level access and higher to modify plugin settings without proper permissions. This vulnerability arises from an insufficient capability check on the Base::get_rest_permission() method, affecting all versions up to and including 2.5.7. Attackers can exploit this weakness to add arbitrary posts to the search exclusion list, undermining the integrity of the data managed by the plugin.

References