CVE-2026-16612: FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwtwcasajaxsearch) and the Details Panel endpoint (dgwtwcasresultdetails) when queried for taxonomy details.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can reach the affected FiboSearch AJAX endpoints may disclose and enumerate password-protected products and their metadata. No product password is required.
Which functionality is affected?
The autocomplete search endpoint, dgwt_wcas_ajax_search, is affected. The Details Panel endpoint, dgwt_wcas_result_details, is also affected when it is queried for taxonomy details.
Are password-protected products fully hidden from unauthenticated search?
No. In affected versions, password-protected products are not consistently excluded from the specified unauthenticated AJAX endpoints.