CVE-2026-16612 in FiboSearch Plugin
Summary
by MITRE • 08/22/2026
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in FiboSearch, a popular WordPress plugin used to enhance site search functionality with AJAX-powered features, represents a significant access control failure within its unauthenticated endpoints. Prior to version 1.34.1, the plugin failed to consistently enforce authentication checks or permission validations when processing requests for password-protected WooCommerce products. This flaw allows any user without valid credentials to interact directly with specific API-like endpoints exposed by the plugin, bypassing the intended security boundaries that restrict access to sensitive product information. The core issue lies in the logic governing how these AJAX handlers process incoming queries and whether they verify the current user's capability to view private or protected content before returning data.
Two primary endpoints are affected by this misconfiguration: the autocomplete search endpoint identified as dgwt_wcas_ajax_search, and the Details Panel endpoint known as dgwt_wcas_result_details when it is queried for taxonomy details. In a secure implementation, these endpoints should check if the requested product requires password protection and, if so, ensure that the requester has provided the correct credentials or possesses administrative privileges. Instead, the vulnerability allows unauthenticated actors to send requests to these endpoints with parameters targeting specific products. The server processes these requests and returns detailed metadata about the protected items without requiring any form of authentication or password entry from the client side.
The operational impact of this flaw is substantial for e-commerce websites relying on FiboSearch. Attackers can enumerate a complete list of password-protected products, which may include limited-edition items, pre-release stock, or internal-only merchandise intended to be hidden from public view. Beyond simple enumeration, the attacker gains access to detailed metadata associated with these products. This information typically includes product titles, descriptions, pricing structures, SKU numbers, and potentially other attributes that could aid in further social engineering attacks or targeted exploitation of related vulnerabilities. The ability to discover protected inventory without authorization undermines the confidentiality guarantees provided by WordPress's native password protection mechanisms for WooCommerce content.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically reflecting failures in enforcing restrictions on resources based on user identity or privileges. It also maps closely to ATT&CK technique T1087, Account Enumeration, as the attacker can systematically probe for the existence of protected accounts and products by observing responses from the API endpoints. The lack of consistent validation across different endpoint types indicates a systemic oversight in the plugin's security architecture rather than an isolated incident, suggesting that other similar handlers might be susceptible to analogous bypasses if not properly audited.
Mitigation strategies must prioritize immediate updates to version 1.34.1 or later, where these access control checks have been corrected. For organizations unable to update immediately due to compatibility constraints with older WordPress core versions or conflicting plugins, temporary mitigation involves restricting direct access to the wp-admin-ajax.php file through web application firewall rules that block unauthorized POST requests containing specific FiboSearch action parameters. Additionally, implementing strict rate limiting on AJAX endpoints can help mitigate automated enumeration attempts while a permanent fix is deployed. Security teams should also audit their WordPress installations for any other plugins exposing similar unauthenticated data retrieval capabilities to ensure comprehensive protection against information disclosure attacks.