Technical impact
The Search Exclude plugin does not validate user capability on its REST API endpoint, allowing any authenticated user with Contributor level or higher to modify the exclusion list. This flaw enables the attacker to add arbitrary posts to the search exclusion list, thereby altering the integrity of search results. The weakness corresponds to CWE‑862, an authorization bypass or improper privilege escalation vulnerability.
Affected Systems
WordPress installations that use the Search Exclude plugin (quadlayers:Search Exclude) version 2.5.7 or earlier are affected. No specific vendor or product name beyond the plugin itself is required, as the plugin is widely distributed in the WordPress plugin repository.
Risk and Exploitability
The CVSS score of 4.3 reflects a moderate severity, but the EPSS score of <1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalogue, and the attack can only be performed by authenticated users who possess at least Contributor rights. As the flaw requires legitimate login credentials and the capability to issue REST API requests, organizations with strict role-based access controls can limit the potential impact. Nevertheless, the ability to tamper with search exclusions could be leveraged to hide content from site visitors or search engines.
