CVE-2024-7630: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Relevanssi Relevanssi Premium
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Premium) via the relevanssi_do_query() due to insufficient limitations on the posts that are returned when searching. This makes it possible for unauthenticated attackers to extract potentially sensitive information from password protected posts.
AI Analysis
Technical Summary
The Relevanssi WordPress plugin, including its Premium version, suffers from an information exposure vulnerability (CWE-200) in all versions up to 4.22.2 (Free) and 2.25.1 (Premium). The issue lies in the relevanssi_do_query() function, which does not adequately limit the posts returned during search operations, enabling unauthenticated users to retrieve content from password-protected posts. This vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), indicating a network attack vector with low complexity and no privileges required. The impact is limited to confidentiality loss without affecting integrity or availability.
Potential Impact
An unauthenticated attacker can leverage this vulnerability to access sensitive information contained within password-protected posts on WordPress sites using affected versions of the Relevanssi plugin. This exposure compromises confidentiality but does not affect data integrity or availability. No evidence of active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Relevanssi plugin or restricting its use to trusted users only to prevent unauthorized information disclosure.
CVE-2024-7630: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Relevanssi Relevanssi Premium
Description
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Premium) via the relevanssi_do_query() due to insufficient limitations on the posts that are returned when searching. This makes it possible for unauthenticated attackers to extract potentially sensitive information from password protected posts.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Relevanssi WordPress plugin, including its Premium version, suffers from an information exposure vulnerability (CWE-200) in all versions up to 4.22.2 (Free) and 2.25.1 (Premium). The issue lies in the relevanssi_do_query() function, which does not adequately limit the posts returned during search operations, enabling unauthenticated users to retrieve content from password-protected posts. This vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), indicating a network attack vector with low complexity and no privileges required. The impact is limited to confidentiality loss without affecting integrity or availability.
Potential Impact
An unauthenticated attacker can leverage this vulnerability to access sensitive information contained within password-protected posts on WordPress sites using affected versions of the Relevanssi plugin. This exposure compromises confidentiality but does not affect data integrity or availability. No evidence of active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Relevanssi plugin or restricting its use to trusted users only to prevent unauthorized information disclosure.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-08-08T20:31:02.510Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6c1cb7ef31ef0b5600de
Added to database: 2/25/2026, 9:39:40 PM
Last enriched: 4/9/2026, 3:06:10 PM
Last updated: 4/12/2026, 1:40:50 PM
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.