CVE-2022-40223
MEDIUMSearchWP <= 4.2.5 - Missing Authorization via Nonce Token Leakage
Title source: llmDescription
Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
References (2)
Core 2
Core References
Third Party Advisory
https://patchstack.com/database/vulnerability/searchwp/wordpress-searchwp-premium-plugin-4-2-5-broken-authentication-vulnerability?_s_id=cve
Release Notes, Vendor Advisory
https://searchwp.com/documentation/changelog/
Scores
CVSS v3
5.4
EPSS
0.0044
EPSS Percentile
35.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (2)
searchwp/searchwp
< 4.2.5
SearchWP, LLC/SearchWP
<= 4.2.5 - 4.2.5
Published
Nov 08, 2022
Tracked Since
Feb 18, 2026