CVE-2025-63069: Ivory Search Authorization Bypass Flaw

CVE-2025-63069 Overview

CVE-2025-63069 is a Missing Authorization vulnerability [CWE-862] in the Ivory Search WordPress plugin (add-search-to-menu) developed by Vinod Dalvi. The flaw stems from incorrectly configured access control checks and affects all versions up to and including 5.5.12. Unauthenticated attackers can reach plugin functionality that should be restricted to authorized users. Successful exploitation results in limited disclosure of information from a WordPress site running the affected plugin.

Critical Impact
Unauthenticated network-based attackers can invoke protected plugin actions in Ivory Search versions 5.5.12 and earlier, resulting in confidentiality impact on affected WordPress installations.

Affected Products

Vinod Dalvi Ivory Search plugin (add-search-to-menu) versions up to and including 5.5.12
WordPress sites running the vulnerable plugin
Any environment exposing the plugin endpoints to untrusted networks

Discovery Timeline

2025-12-09 - CVE-2025-63069 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-63069

Vulnerability Analysis

The Ivory Search plugin extends WordPress menus with search functionality. The vulnerability is classified as Missing Authorization [CWE-862]. The plugin exposes one or more actions that do not verify whether the requester holds the required capability or role. An attacker can invoke these actions directly over the network without valid credentials.

The impact is limited to confidentiality. There is no direct effect on integrity or availability of the WordPress installation. Attackers can read plugin data or configuration that should be restricted. The attack requires no user interaction and no privileges, making it well-suited for automated scanning against internet-facing WordPress sites.

At the time of publication, there is no evidence of public exploit code or in-the-wild exploitation. The EPSS score is 0.3%, reflecting a low current probability of exploitation activity.

Root Cause

The root cause is an incorrect access control configuration inside the plugin. Handler functions for plugin actions omit the capability checks (such as current_user_can()) or nonce validation (check_admin_referer() / wp_verify_nonce()) that WordPress uses to enforce authorization. Because the checks are missing, WordPress serves the request as if the caller were authorized.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting Ivory Search. An attacker sends crafted HTTP requests to the plugin endpoints, typically via admin-ajax.php, admin-post.php, or a REST route registered by the plugin. Because no authorization check exists, the plugin executes the requested action and returns data to the unauthenticated caller. Refer to the Patchstack advisory for technical details on the specific vulnerable endpoint.

Detection Methods for CVE-2025-63069

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to admin-ajax.php with action parameters registered by the Ivory Search plugin
Requests to plugin REST routes under /wp-json/ originating from IPs without a corresponding authentication cookie
Access logs showing repeated requests to add-search-to-menu plugin endpoints from a single source

Detection Strategies

Inventory WordPress sites and identify installations of the Ivory Search plugin at version 5.5.12 or lower using the /wp-content/plugins/add-search-to-menu/ path
Inspect web server access logs for unauthenticated requests targeting plugin AJAX and REST endpoints
Deploy WAF rules that require an authenticated session cookie for plugin administrative actions

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress reverse proxies to capture full URLs and query strings
Alert on anomalous traffic volumes to plugin endpoints from single IPs or non-browser user agents
Correlate plugin endpoint access with WordPress authentication events to identify unauthenticated calls

How to Mitigate CVE-2025-63069

Immediate Actions Required

Identify all WordPress sites running Ivory Search versions up to and including 5.5.12
Update the plugin to a version above 5.5.12 once the vendor publishes a fixed release
If a patched version is not yet available, deactivate and remove the plugin until a fix is released
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes from untrusted networks where feasible

Patch Information

Refer to the Patchstack advisory for Ivory Search for the latest fixed version information. The vulnerability affects all versions through 5.5.12. Administrators should upgrade to the vendor-supplied patched release as soon as it becomes available in the WordPress plugin repository.

Workarounds

Deactivate the Ivory Search plugin until a patched version is installed
Deploy a virtual patch via a web application firewall to block unauthenticated requests to the vulnerable plugin endpoints
Apply IP allow-listing at the reverse proxy for administrative and AJAX endpoints where operationally feasible

bash

# Example: WAF rule concept to block unauthenticated Ivory Search AJAX actions
# (adapt to your WAF syntax - ModSecurity example)
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
  "chain,phase:2,deny,status:403,id:1006306901,\
   msg:'CVE-2025-63069 Ivory Search unauthenticated access blocked'"
  SecRule ARGS:action "@rx ^(ivory_search|is_)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"