The Ivory Search – WordPress Search Plugin for WordPress contains a missing capability check in the ajax_create_index() function in all versions up to 5.5.5. This flaw permits authenticated users with low-level privileges (subscriber and above) to initiate the creation of search indexes, which constitutes unauthorized modification of plugin data. The vulnerability is identified as CWE-862 (Missing Authorization). The CVSS v3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows authenticated attackers with subscriber-level access or higher to perform unauthorized actions by triggering index creation in the Ivory Search plugin. This could lead to unintended or malicious modification of search index data. There is no direct impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until then, consider restricting subscriber-level access if feasible or monitoring for unusual index creation activity related to this plugin.