CVE-2026-16612
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The FiboSearch WordPress plugin before version 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints. This allows unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
Risk Assessment
Disclosure of password-protected products and their metadata can compromise confidentiality of data intended only for authorized users. This may lead to leakage of commercial information.
Recommendation
Update the FiboSearch plugin to version 1.34.1 or later. Verify that password-protected products are correctly excluded from search results.
Other vulnerabilities in FiboSearch
See all- CVE-2026-96553High
A Reflected Cross-Site Scripting (XSS) vulnerability in the FiboSearch plugin for WordPress, affecting versions up to 1.34.1, allows an attacker to inject malicious scripts into the page.
- CVE-2026-28179Medium
Cross Site Scripting (XSS) vulnerability in FiboSearch versions up to 1.33.0 allows a Shop manager user to inject malicious script.
Original NVD description (English source)
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS