The Search Exclude plugin for WordPress suffers from a missing capability check in its get_rest_permission function, which leads to unauthorized modification of plugin settings. Specifically, unauthenticated attackers can alter the exclusion list for search results, potentially impacting content visibility. This vulnerability is classified under CWE-862 (Missing Authorization). It affects all versions up to and including 2.4.9. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges or user interaction required, causing integrity impact but no confidentiality or availability impact.

An attacker without authentication can modify the Search Exclude plugin settings, changing which content is excluded from WordPress search results. This could lead to unauthorized alteration of site search behavior, potentially hiding or excluding content unexpectedly. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the REST API endpoints related to the Search Exclude plugin or disabling the plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.