CVE-2026-16612

MediumCVSS 5.3

Published: 22/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The FiboSearch WordPress plugin before version 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints. This allows unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.

Risk Assessment

Disclosure of password-protected products and their metadata can compromise confidentiality of data intended only for authorized users. This may lead to leakage of commercial information.

Recommendation

Update the FiboSearch plugin to version 1.34.1 or later. Verify that password-protected products are correctly excluded from search results.

Other vulnerabilities in FiboSearch

CVE-2026-28179Medium
Cross Site Scripting (XSS) vulnerability in FiboSearch versions up to 1.33.0 allows a Shop manager user to inject malicious script.

Original NVD description (English source)

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.