CVE-2024-3213 is a medium severity (CVSS 5.3) missing authorization flaw in the Relevanssi search plugin for WordPress, in versions up to and including 4.22.1. The relevanssi_update_counts function lacks a capability check, so unauthenticated users can trigger expensive queries. Update the plugin to 4.22.2 or later.
What's affected
Relevanssi, a better search plugin for WordPress, in all versions up to and including 4.22.1. The record says the missing check is on relevanssi_update_counts() in lib/admin-ajax.php and that unauthenticated attackers can run expensive queries that could lead to denial of service.
The record links a WordPress plugin changeset for the 4.22.2 tag, so 4.22.2 is the release that carries the change. We did not review the plugin changelog itself, so confirm the fix note there.
CVE-2024-3214, a CSV injection issue in the same plugin and version range, is fixed in the same release according to its changeset link.
The weakness class: CWE-862, missing authorization. The NVD record scores it 5.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description speaks of unauthorized modification of data, while the impact in the same text and in NVD is availability (denial of service) with a 5.3 score. Both are published.
How to check if you're exposed
In WordPress, open Plugins, find Relevanssi and read the version. From the command line with WP-CLI:
wp plugin list --name=relevanssi --fields=name,version,update
If the version is 4.22.1 or lower, you are in range. Also check the premium edition if you use it, and confirm its release notes.
What to do now
- Update Relevanssi to 4.22.2 or later on every WordPress site you run.
- Confirm the version after the update and clear caches.
- Review web server and database load for unexplained spikes that might point to abuse of admin AJAX.
- Consider rate limiting requests to admin-ajax.php at the edge.
Why it matters
The class is CWE-862, missing authorization. A WordPress AJAX action ran without checking that the caller was allowed to run it, so anyone who could reach the site could trigger the work. The record lists the CWE twice, which is a data quirk.
The impact is limited to expensive queries and possible slowdown, hence the medium score. For busy sites a cheap way to degrade availability is still a real problem.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this flaw let attackers change my content?
The title wording speaks of unauthorized modification of data, but the described effect is running costly queries that could cause denial of service. Check the plugin changelog if you need the precise impact for your risk record.
Sources
- Relevanssi 4.22.2 changeset on WordPress.org (listed in the record, not individually reviewed)
- Wordfence entry (listed in the record; our fetch returned no content)
- Safeguard Gold entry for CVE-2024-3213
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
