The Search Simple Fields plugin for WordPress is vulnerable due to missing nonce validation in the search_simple_fields_options() function, allowing unauthenticated attackers to alter the plugin’s settings via forged POST requests. This CSRF flaw lets attackers change search post types, custom fields, media fields and the custom media function name, effectively hijacking how the site’s search behaves. The weakness is a classic Cross‑Site Request Forgery (CWE‑352) error.

Versions of the Search Simple Fields plugin from Simon Ailie up to and including 0.2 are affected. The vulnerability occurs in the functions_admin.php file when an attacker submits a crafted request to the plugin’s options handler.

The CVSS score of 4.3 indicates moderate severity; no EPSS data is available and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to convince a site administrator to click a malicious link or submit a forged form while logged in. Once the administrative session is active, the attacker can remotely modify plugin configuration without needing any user credentials. The risk is contained to sites running the vulnerable plugin and depends on admin interaction, but the potential impact on site functionality is significant.