CVE-2026-8617: SearchPlus WordPress Auth Bypass Flaw

CVE-2026-8617 Overview

CVE-2026-8617 affects the SearchPlus plugin for WordPress in all versions up to and including 1.7.1. The vulnerability allows unauthenticated attackers to modify or delete the plugin's stored account token and account name options. The flaw stems from missing capability checks and missing nonce validation in two AJAX callback functions registered through wp_ajax_nopriv_ hooks. An attacker can overwrite or erase the dym_token, dym_name, searchplus_token, searchplus_name, sp_token, and sp_name options without authentication. The issue is classified under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated network attackers can disrupt SearchPlus plugin functionality by overwriting or deleting stored account tokens, breaking integrations that depend on those credentials.

Affected Products

SearchPlus plugin for WordPress, all versions through 1.7.1
WordPress sites with the wp_ajax_nopriv_ hooks for searchplus_save_token_action_callback() exposed
WordPress sites with the wp_ajax_nopriv_ hooks for searchplus_reset_token_action_callback() exposed

Discovery Timeline

2026-06-24 - CVE-2026-8617 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-8617

Vulnerability Analysis

The SearchPlus plugin registers two AJAX endpoints intended to manage the plugin's account token and name. The searchplus_save_token_action_callback() function stores token and name values, while searchplus_reset_token_action_callback() clears them. Both callbacks are attached to wp_ajax_nopriv_ action hooks, meaning WordPress invokes them for unauthenticated visitors. Neither function performs a capability check via current_user_can() nor verifies a nonce with check_ajax_referer() or wp_verify_nonce(). As a result, any remote actor who can reach wp-admin/admin-ajax.php can call the endpoints directly. The impact is limited to integrity of plugin-managed options. Successful exploitation rewrites or removes the dym_token, dym_name, searchplus_token, searchplus_name, sp_token, and sp_name options stored in wp_options.

Root Cause

The root cause is broken access control on AJAX endpoints. The plugin exposes privileged state-changing actions through unauthenticated hooks without authentication, authorization, or CSRF protections. See the SearchPlus 1.7.1 source listing on plugins.trac for the affected callback registration.

Attack Vector

An attacker sends a crafted HTTP POST request to wp-admin/admin-ajax.php with an action parameter targeting either callback. No authentication, session, or user interaction is required. The attacker supplies arbitrary values for the token and name parameters, which the plugin persists with update_option(), or triggers the reset path to delete them. Repeated exploitation can lock administrators out of the plugin's third-party integration or substitute attacker-controlled identifiers in the stored options.

No verified public exploit code is available. Refer to the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2026-8617

Indicators of Compromise

Unexpected values or empty strings in the dym_token, dym_name, searchplus_token, searchplus_name, sp_token, or sp_name rows of the wp_options table.
HTTP POST requests to /wp-admin/admin-ajax.php containing action=searchplus_save_token_action or action=searchplus_reset_token_action from unauthenticated sources.
SearchPlus integration failures or authentication errors reported by site administrators following anomalous traffic.

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php referencing the SearchPlus action names without an authenticated wordpress_logged_in_* cookie.
Compare current values of SearchPlus options against a known-good baseline using wp option get for each affected option name.
Alert on bursts of admin-ajax.php requests from a single source IP that target plugin-specific actions.

Monitoring Recommendations

Enable WordPress audit logging to capture changes to wp_options entries beginning with dym_, searchplus_, or sp_.
Route web server and WordPress audit logs to a centralized SIEM for correlation across requests, option changes, and administrative sessions.
Monitor outbound traffic from the WordPress host for connections to unexpected endpoints that may indicate redirection through a tampered token.

How to Mitigate CVE-2026-8617

Immediate Actions Required

Update the SearchPlus plugin to a release later than 1.7.1 once the vendor publishes a fix.
If no fixed version is available, deactivate and remove the SearchPlus plugin from affected WordPress installations.
Restore the legitimate values of dym_token, dym_name, searchplus_token, searchplus_name, sp_token, and sp_name from a trusted backup if tampering is suspected.
Rotate any third-party API tokens or credentials that were stored in the affected option values.

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. Site operators should consult the Wordfence advisory and the plugin's WordPress.org page for an updated release that adds capability checks and nonce validation to the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions.

Workarounds

Block requests to /wp-admin/admin-ajax.php with action=searchplus_save_token_action or action=searchplus_reset_token_action at a Web Application Firewall when the request lacks an authenticated session cookie.
Restrict access to admin-ajax.php from untrusted networks where feasible, accepting that legitimate front-end functionality may be impacted.
Use a mu-plugin to unregister the wp_ajax_nopriv_searchplus_save_token_action and wp_ajax_nopriv_searchplus_reset_token_action hooks until an official patch is applied.

bash

# Example: verify current SearchPlus option values using WP-CLI
wp option get dym_token
wp option get dym_name
wp option get searchplus_token
wp option get searchplus_name
wp option get sp_token
wp option get sp_name