CVE-2022-2535

Name of the Vulnerable Software and Affected Versions SearchWP Live Ajax Search WordPress plugin versions prior to 1.6.2

Description The issue allows unauthenticated users to make a crafted query, disclosing private, draft, and pending post titles along with their permalinks, because it does not limit live search results to published posts only.

Recommendations For versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the live search functionality until the update is applied.