CVE-2025-63069

MediumCVSS 5.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

23th percentile - higher than 23% of all known CVEs

Summary

The Ivory Search plugin (add-search-to-menu) by Vinod Dalvi has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.5.12.

Risk Assessment

Unauthorized users may gain access to search functionality or data, potentially leading to privacy or integrity breaches. The organization may be exposed to information leakage.

Recommendation

It is recommended to update the Ivory Search plugin to the latest version and implement proper authorization mechanisms. Also monitor access logs.

Other vulnerabilities in Ivory Search

CVE-2026-92243Medium
The Ivory Search plugin for WordPress up to version 5.5.18 is vulnerable to reflected XSS via the 's' parameter. Unauthenticated attackers can inject scripts that execute when a user accesses a page with search results.

Original NVD description (English source)

Missing Authorization vulnerability in Vinod Dalvi Ivory Search add-search-to-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ivory Search: from n/a through <= 5.5.12.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS