CVE-2025-10646: WordPress Search Exclude Auth Bypass Flaw

CVE-2025-10646 Overview

CVE-2025-10646 is a missing authorization vulnerability [CWE-862] in the Search Exclude plugin for WordPress. The flaw resides in the Base::get_rest_permission() method and affects all versions up to and including 2.5.7. The method performs an insufficient capability check on REST API requests. Authenticated users with Contributor-level access or above can modify plugin settings, including adding arbitrary posts to the search exclusion list. The vulnerability requires valid authentication but no user interaction. Successful exploitation impacts data integrity on affected WordPress sites by allowing unauthorized changes to search visibility configuration.

Critical Impact
Authenticated contributors can modify Search Exclude plugin settings and hide arbitrary posts from WordPress site search results.

Affected Products

Search Exclude plugin for WordPress, versions up through 2.5.7
WordPress sites running the plugin with Contributor-level accounts or above
Any WordPress deployment permitting self-registration at Contributor role

Discovery Timeline

2025-11-25 - CVE-2025-10646 published to the National Vulnerability Database
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-10646

Vulnerability Analysis

The Search Exclude plugin exposes REST API endpoints for managing which posts are hidden from WordPress search results. Access to these endpoints is gated by the Base::get_rest_permission() method. This method implements an authentication check but does not verify that the caller holds a capability appropriate for modifying site-wide plugin settings. As a result, any authenticated user at or above the Contributor role can invoke the endpoint and alter the exclusion list.

The issue is categorized under CWE-862: Missing Authorization. The impact is limited to integrity of plugin configuration data. Confidentiality and availability are not directly affected. The EPSS score at time of writing is 0.182%, reflecting low observed exploitation probability.

Root Cause

The root cause is a permission callback that validates only that a request is authenticated, rather than confirming the caller has an administrative capability such as manage_options. REST route registration in WordPress relies on the permission_callback to enforce authorization. When that callback returns true for any logged-in user, the endpoint effectively becomes available to the lowest privileged roles.

Attack Vector

Exploitation is remote and network-based. An attacker first obtains or registers a WordPress account with Contributor privileges. The attacker then sends an authenticated REST API request to the vulnerable Search Exclude endpoint with a crafted payload specifying post IDs to add to the exclusion list. The server accepts the request and persists the configuration change. See the Wordfence vulnerability report and the plugin changeset for additional technical detail.

// No verified exploit code published. See referenced advisories for technical details.

Detection Methods for CVE-2025-10646

Indicators of Compromise

Unexpected posts missing from front-end search results on affected WordPress sites
REST API requests from Contributor accounts to Search Exclude plugin endpoints under /wp-json/
Changes to Search Exclude plugin options in the wp_options table not initiated by an administrator
Audit log entries showing plugin setting modifications attributed to low-privilege user accounts

Detection Strategies

Inspect web server access logs for authenticated REST API calls targeting Search Exclude routes, correlated with user role
Enable WordPress activity logging to record plugin option changes and the account responsible
Compare current Search Exclude configuration against a known-good baseline on a scheduled basis
Alert on any POST or PUT requests to Search Exclude endpoints originating from non-administrator sessions

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM for correlation across sites
Monitor creation of new Contributor-level accounts, especially on sites with open registration
Review Search Exclude plugin settings weekly on high-value content sites
Track plugin version inventory to confirm all instances are upgraded past 2.5.7

How to Mitigate CVE-2025-10646

Immediate Actions Required

Update the Search Exclude plugin to the version that addresses CVE-2025-10646, as published in the WordPress plugin changeset 3379004
Audit existing Contributor, Author, and Editor accounts and remove any that are unused or unverified
Review the current Search Exclude configuration and restore any posts incorrectly excluded from search
Disable open user registration if Contributor accounts are not required

Patch Information

The fix is tracked in WordPress plugin changeset 3379004. The patched release updates the Base::get_rest_permission() method to require an appropriate administrative capability before allowing modifications to plugin settings. Administrators should upgrade through the WordPress dashboard plugin updater or by replacing the plugin directory under wp-content/plugins/search-exclude/.

Workarounds

Deactivate the Search Exclude plugin until the patched version can be deployed
Restrict REST API access to the Search Exclude endpoints at the web application firewall layer
Temporarily remove the Contributor role from untrusted user accounts
Apply least-privilege principles and avoid granting Contributor or higher roles to anonymous registrants

bash

# Example: list installed plugin version via WP-CLI
wp plugin get search-exclude --field=version

# Example: update to the latest fixed version
wp plugin update search-exclude