The Ivory Search – WordPress Search Plugin for WordPress versions up to 5.5.6 contains an information exposure vulnerability (CWE-200) in the ajax_load_posts function. This flaw enables unauthenticated attackers to perform a boolean-based attack on the AJAX search form to extract text data from password-protected posts. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability does not impact integrity or availability, only confidentiality.

An attacker can gain unauthorized access to text content from password-protected posts, potentially leaking sensitive information. The impact is limited to confidentiality loss without affecting integrity or availability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Ivory Search plugin or restricting access to the AJAX search functionality to trusted users only to mitigate exposure risk.