CVE-2025-10646: CWE-862 Missing Authorization in quadlayers Search Exclude
The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permission() method in all versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings, such as adding arbitrary posts to the search exclusion list.
AI Analysis
Technical Summary
The Search Exclude WordPress plugin suffers from a missing authorization vulnerability (CWE-862) due to an insufficient capability check in the Base::get_rest_permission() method. This flaw permits authenticated users with Contributor-level privileges or above to modify plugin settings, specifically to add arbitrary posts to the search exclusion list. The vulnerability affects all versions up to and including 2.5.7. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact on integrity without affecting confidentiality or availability. No patch or vendor advisory is currently available.
Potential Impact
Authenticated users with Contributor-level access or higher can modify plugin settings without proper authorization, potentially altering the search exclusion list by adding arbitrary posts. This impacts the integrity of the plugin's configuration but does not affect confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor plugin settings for unauthorized changes.
CVE-2025-10646: CWE-862 Missing Authorization in quadlayers Search Exclude
Description
The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permission() method in all versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings, such as adding arbitrary posts to the search exclusion list.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Search Exclude WordPress plugin suffers from a missing authorization vulnerability (CWE-862) due to an insufficient capability check in the Base::get_rest_permission() method. This flaw permits authenticated users with Contributor-level privileges or above to modify plugin settings, specifically to add arbitrary posts to the search exclusion list. The vulnerability affects all versions up to and including 2.5.7. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact on integrity without affecting confidentiality or availability. No patch or vendor advisory is currently available.
Potential Impact
Authenticated users with Contributor-level access or higher can modify plugin settings without proper authorization, potentially altering the search exclusion list by adding arbitrary posts. This impacts the integrity of the plugin's configuration but does not affect confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor plugin settings for unauthorized changes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-09-17T17:09:04.119Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 692527c82a08b12b0e80cc0a
Added to database: 11/25/2025, 3:51:36 AM
Last enriched: 4/9/2026, 9:01:36 AM
Last updated: 5/10/2026, 3:47:05 AM
Views: 138
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.