Search Analytics for WP < 1.5.0 - Missing Authorization
Description
The Search Analytics for WP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 1.5.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v1.5.0
Source Code
WordPress.org SVN# Search Analytics for WP < 1.5.0 - Missing Authorization (CVE-2026-27357) The Search Analytics for WP plugin is vulnerable to unauthorized access and option manipulation due to missing capability checks in its AJAX handlers. Specifically, the `render_chart_data` and `save_default_chart_settings` f…
Show full research plan
Search Analytics for WP < 1.5.0 - Missing Authorization (CVE-2026-27357)
The Search Analytics for WP plugin is vulnerable to unauthorized access and option manipulation due to missing capability checks in its AJAX handlers. Specifically, the render_chart_data and save_default_chart_settings functions in MWTSA_Admin_Charts verify a nonce but do not check if the user has administrative privileges. Although the provided source only shows wp_ajax_ registrations (authenticated), the CVE's PR:N rating and unauthenticated description imply that either wp_ajax_nopriv_ hooks are present in the vulnerable versions or the nonce is accessible to unauthenticated users, allowing them to view search statistics or modify global plugin settings.
1. Vulnerability Summary
- ID: CVE-2026-27357
- Type: Missing Authorization
- Vulnerable Functions:
MWTSA_Admin_Charts::render_chart_dataandMWTSA_Admin_Charts::save_default_chart_settings. - Root Cause: These functions rely solely on
wp_verify_nonce()for security. In WordPress, nonces are for CSRF protection, not authorization. Any user (or potentially an unauthenticated one if the nonce is leaked) who can obtain a validmwtsa_chart_noncecan invoke these functions. - Impact:
- Information Disclosure: Unauthenticated/
Summary
The Search Analytics for WP plugin for WordPress is vulnerable to unauthorized access and option manipulation due to missing capability checks in its AJAX handlers. This allows authenticated users, regardless of their role, to view search statistics and modify global plugin settings if they can obtain a valid nonce.
Vulnerable Code
// admin/includes/class.charts.php public function render_chart_data() { $nonce = isset( $_REQUEST['nonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ) : ''; if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, $this->nonce_action ) ) { wp_send_json_error( 'Bad Request!' ); } $ranges = ! empty( $_REQUEST['chart_ranges'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['chart_ranges'] ) ) : '2w'; // ... (logic to return search statistics) } --- // admin/includes/class.charts.php public function save_default_chart_settings() { $nonce = isset( $_REQUEST['nonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ) : ''; if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, $this->nonce_action ) ) { wp_send_json_error( 'Bad Request!' ); } if ( empty( $_POST['line_style'] ) || empty( $_POST['chart_ranges'] ) ) { wp_send_json_error( 'Bad Request!' ); } // ... (sanitization logic) MWTSA_Options::set_options( array( 'chart_default_range' => $chart_ranges, 'chart_default_line_style' => $line_style ) ); wp_send_json_success(); }
Security Fix
@@ -89,10 +89,7 @@ } public function render_chart_data() { - $nonce = isset( $_REQUEST['nonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ) : ''; - - if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, $this->nonce_action ) ) { - wp_send_json_error( 'Bad Request!' ); - } + check_ajax_referer( $this->nonce_action ); $ranges = ! empty( $_REQUEST['chart_ranges'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['chart_ranges'] ) ) : '2w'; @@ -125,11 +122,7 @@ } public function save_default_chart_settings() { - $nonce = isset( $_REQUEST['nonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ) : ''; - - if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, $this->nonce_action ) ) { - wp_send_json_error( 'Bad Request!' ); - } + check_ajax_referer( $this->nonce_action ); if ( empty( $_POST['line_style'] ) || empty( $_POST['chart_ranges'] ) ) { wp_send_json_error( 'Bad Request!' );
Exploit Outline
1. **Identify the Nonce**: The attacker must obtain the `mwtsa_chart_nonce`. This is typically localized in the `mwtsa_chart_obj` JavaScript object on any page where the search analytics dashboard is loaded. If the dashboard is accessible to lower-privileged roles (like Subscribers) due to misconfiguration or if the nonce is leaked globally, it can be harvested. 2. **Target Endpoint**: Perform an AJAX POST request to `/wp-admin/admin-ajax.php`. 3. **View Analytics Data**: Send a payload with `action=render_chart_data`, `nonce=[harvested_nonce]`, and `chart_ranges=1m`. The server will return the daily search counts and terms in JSON format, bypassing administrative restrictions. 4. **Modify Settings**: Send a payload with `action=save_default_chart_settings`, `nonce=[harvested_nonce]`, `line_style=stepped`, and `chart_ranges=2wc`. This will overwrite the global default chart settings in the plugin's configuration options.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.