This scenario describes an active exploitation of a vulnerable application feature. The ECIH Web Application Incident Handling module emphasizes that when a specific feature is being abused, immediate containment requires removing or disabling that attack surface.

Option B is correct because disabling the vulnerable advanced search feature immediately stops further exploitation while allowing the team to analyze and remediate the flaw safely. ECIH warns against leaving known-vulnerable functionality active during investigation.

Options A and C improve authentication but do not stop exploitation of backend logic. Option D protects stored data but does not prevent further abuse.

Therefore, disabling the exploited feature is the best immediate action.