CVE-2024-7573 Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection
Unauthenticated attackers can inject arguments into WP_Query to expose sensitive information like attachments or private posts in the Relevanssi Live Ajax Search plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7573?
CVE-2024-7573 is a medium-severity vulnerability in comesio Relevanssi Live Ajax Search, published on 28 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject arbitrary arguments into a WP_Query query and potentially expose sensitive information such as attachments or private posts.
Weakness: CWE-88
Which versions are affected by CVE-2024-7573?
How do I fix CVE-2024-7573?
No fix has been published for CVE-2024-7573 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-7573 being exploited?
There is no known exploitation of CVE-2024-7573 in the wild and no public exploit code.
Sources
Also known as GHSA-frvq-jf8m-34q5.