Atomic Edge analysis of CVE-2026-61977 (metadata-based): The JetSearch plugin for WordPress, versions up to and including 3.6.1.2, exposes sensitive information to unauthenticated attackers. The vulnerability is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, with a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The attack requires no authentication and no user interaction, and it can be performed over the network. Atomic Edge research infers that the vulnerable component is likely an AJAX handler or REST endpoint that fails to enforce capability checks and nonce validation, allowing unauthenticated access to internal data.
Root Cause: The root cause is the absence of proper authorization checks on a data retrieval function. Since the plugin handles search functionality, it likely registers an AJAX action or REST route that returns search results or related metadata. Without a nonce and capability check, an unauthenticated attacker can invoke this endpoint to extract sensitive configuration data, such as database prefixes, API keys, or user information. This conclusion is inferred from the CWE classification and the known WordPress plugin vulnerability pattern; no source code was available for confirmation. The patched version 3.6.1.3 likely adds nonce verification and capability validation to the affected handler.
Exploitation: An attacker would send a crafted HTTP request to the WordPress AJAX endpoint, /wp-admin/admin-ajax.php, with the action parameter set to a JetSearch-specific handler. The handler name typically follows the JetSearch naming convention, such as ‘jet_search_query’ or ‘jet_search_get_data’. Because the vulnerability allows information exposure without authentication, no nonce is required. The request would include a parameter that specifies the data type to retrieve, such as ‘data_type=users’ or ‘config=true’. The server processes the request without checking user permissions, and the response contains the sensitive information. The attack is straightforward: it does not require any special tools beyond a standard HTTP client like cURL. Atomic Edge analysis demonstrates the exploit with a basic AJAX request.
Remediation: The fix for this vulnerability must enforce proper authorization on the vulnerable data retrieval endpoint. Developers should add a nonce check using wp_verify_nonce() and a capability check such as current_user_can() before processing any request. If the endpoint is intended for all users, the response should be strictly limited to non-sensitive data. Additionally, the plugin should never expose configuration details, user lists, or database information through publicly accessible handlers. The patched version 3.6.1.3 addresses these issues, and users should update immediately. Virtual patching can block exploit attempts by denying requests to the affected AJAX action without valid nonces, but if nonce validation is absent, the WAF rule must match the specific handler and data type parameter.
Impact: Successful exploitation allows an unauthenticated attacker to extract sensitive information from the WordPress installation. This can include usernames, email addresses, user meta data, or internal plugin configuration such as API keys and database settings. The exposed data can aid in further attacks, such as targeted phishing, credential stuffing, or privilege escalation if combined with other vulnerabilities. The CVSS score of 5.3 reflects the limited confidentiality impact and no impact on integrity or availability. However, the security impact is significant because it breaks the trust boundary between unauthenticated users and internal data.
