CVE-2026-8617

The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions, both of which are exposed to unauthenticated users through the wp_ajax_nopriv_ hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin's stored account token and account name options (dym_token, dym_name, searchplus_token, searchplus_name, sp_token, sp_name).

• CWE-862

• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L24
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L39
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L45
• https://plugins.trac.wordpress.org/browser/searchplus/tags/1.7.1/includes/functions.php#L57
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b1800f37-f9ab-454b-84f7-4d5eb5ed3acf?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86164A security flaw has been discovered in itsourcecode Sales an…6.3
• CVE-2026-86165A vulnerability was found in Tenda HG10 300001138. This vuln…9.8
• CVE-2026-86166A vulnerability was determined in Tenda HG10 300001138. This…8.8
• CVE-2026-86167A vulnerability was identified in Tenda HG10 300001138. Impa…9.9
• CVE-2026-86168A security flaw has been discovered in code-projects Content…7.3
• CVE-2026-86169Axolotl before 0.19.0 contains a remote code execution vulne…8.8
• CVE-2026-86170A weakness has been identified in DefaultFuction CRM 1.0.0. …6.3
• CVE-2026-86171A security vulnerability has been detected in DefaultFuction…6.3
• CVE-2026-86172A vulnerability was detected in DefaultFuction CRM 1.0.0. Th…6.3
• CVE-2026-86173MindsDB through 26.1.0 contains a server-side request forger…7.5
• CVE-2026-86174Plane through 1.4.2 fails to validate that issues belong to …4.3
• CVE-2026-86175NetBox through 4.7.0 fails to redact sensitive data source b…6.5