CVE-2026-16612 - FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

Back Back to CVE browser

MEDIUM

FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

Published Aug 22, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.

Affected products

Vendor n/a Product FiboSearch Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.34.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

FiboSearch

unaffected

Version	Status	Constraints
0	affected	<1.34.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64217
Advisory
https://wpscan.com/vulnerability/705cf14a-2782-408a-80b1-be7a9da6bbdd/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64217		Advisory
https://wpscan.com/vulnerability/705cf14a-2782-408a-80b1-be7a9da6bbdd/		exploitvdb-entrytechnical-description