Unauthorized Data Modification in SearchPlus Plugin for WordPress

CVE-2026-8617

What is CVE-2026-8617?

The SearchPlus plugin for WordPress has a security vulnerability that allows unauthorized users to modify and delete important data. Versions up to and including 1.7.1 are affected due to a lack of proper capability checks and nonce validation in critical functions exposed through AJAX calls. Consequently, attackers can manipulate the stored account tokens and names, potentially disrupting the functionality of the plugin and compromising the integrity of user data. It is essential for users to upgrade to the latest version to mitigate this risk.

References