CVE-2022-2535 SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
Unauthenticated attackers can disclose private, draft, and pending post titles and permalinks via crafted live search queries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2535?
CVE-2022-2535 is a medium-severity vulnerability in Unknown SearchWP Live Ajax Search, published on 15 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
Weakness: CWE-639
Which versions are affected by CVE-2022-2535?
It affects 1 product.
Products include Searchwp Searchwp Live Ajax Search.
How do I fix CVE-2022-2535?
No fix has been published for CVE-2022-2535 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2535 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2535 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-v492-qvfp-r274.