WordPress Plugin Vulnerabilities

Search Exclude < 2.5.0 - Missing Authorization to Unauthenticated Plugin Settings Modification

Description

The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results.

Affects Plugins

Plugin icon
search-exclude
Fixed in 2.5.0

References

CVE
CVE-2025-2821
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1f72a309-8ef8-4943-8e64-38bb7909397a

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Noah Stead (TurtleBurg)
Verified
No
WPVDB ID
17f2c2c1-f42a-4854-a11c-d612eedee532

Timeline

Publicly Published
2025-05-06 (about 1 year ago)
Added
2025-05-06 (about 1 year ago)
Last Updated
2025-05-07 (about 1 year ago)

Other

Published
Title
Published
2025-02-17
Title
GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Published
2026-03-18
Title
Print Invoice & Delivery Notes for WooCommerce < 6.0.0 - Missing Authorization
Published
2026-01-21
Title
WP Docs < 2.2.9 - Missing Authorization
Published
2026-02-25
Title
Bakery Autoresponder Addon <= 1.0.6 - Missing Authorization
Published
2024-10-07
Title
Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Missing Authorization to Authenticated (Subscriber+) Private Gallery Title Disclosure