CVE-2026-8617 is a missing authorization vulnerability (CWE-862) in the SearchPlus WordPress plugin by ailchev. The issue arises because the functions searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() lack capability checks and nonce validation, and are accessible via wp_ajax_nopriv_ hooks. This allows unauthenticated attackers to overwrite or delete sensitive plugin options such as dym_token, dym_name, searchplus_token, searchplus_name, sp_token, and sp_name. The vulnerability affects versions up to and including 1.7.1.

An unauthenticated attacker can modify or delete stored account tokens and account name options within the plugin. This impacts the integrity of the plugin's stored data but does not affect confidentiality or availability according to the CVSS vector. The CVSS score is 5.3 (medium severity), reflecting the potential for unauthorized data modification without requiring privileges or user interaction.

No official patch or remediation has been confirmed at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX endpoints if possible or implement custom authorization checks to prevent unauthenticated access to these functions.