WordPress Search Exclude Plugin Missing Authorization Vulnerability in REST API

A vulnerability exists in the Search Exclude plugin for WordPress, specifically in versions up to and including 2.5.7. The issue arises from an inadequate capability check in the Base::get_rest_permission() method, allowing authenticated attackers with Contributor-level access and above to unauthorizedly modify plugin settings. This includes the ability to add arbitrary posts to the search exclusion list. The vulnerability enables unauthorized data modification through the WordPress REST API.

Impact

Exploitation of this vulnerability allows for unauthorized modification of search exclusion settings, potentially leading to the inclusion of excluded posts in search results.

Remediation

Users can update to version 2.5.8 or a newer patched version to address this vulnerability.