Skip to content
Submit incident
AII-1002-46067
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

SmartSearchWP plugin vulnerable to OpenAI key disclosure

SmartSearchWP plugin versions before 2.4.6 contain an incorrect authorization vulnerability that allows unauthenticated users to access and disclose OpenAI API keys. The vulnerability was identified as CVE-2024-6845 with a CVSS score of 5.3 (medium severity).

4 September 2024 · SmartSearchWP · Security and cyberattacks
4 September 2024

Drafted by Raidu Incident Detection, an automated system.

AII-1002-460672 sources ↓
Quick facts
Category
Security and cyberattacks
Source
wpscan.com
Date
4 September 2024
Drafted by
Raidu Incident Detection

What happened

SmartSearchWP versions before 2.4.6 contain an incorrect authorization vulnerability that allows unauthenticated access to OpenAI API keys.

Index analysis

The vulnerability was classified as broken access control under OWASP A5 with CWE-863, with a CVSS score of 5.3 (medium severity).

Classification

Category
Security and cyberattacks
Industry
Digital security
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Harmed
Business
Failure modes
Data leak
AI systems
OpenAI API

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

wpscan.com
https://wpscan.com/vulnerability/cfaaa843-d89e-42d4-90d9-988293499d26/
cve.org
NVD entry