Description

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-22T06:16:15.130Z",
  "pubdate": "2026-08-22T06:16:15.130Z",
  "executiveSummary": "The FiboSearch WordPress plugin before version 1.34.1 suffers from an access control vulnerability involving unauthenticated AJAX endpoints that fail to consistently enforce visibility restrictions for password-protected products. This security flaw allows unauthenticated remote attackers to enumerate and disclose sensitive metadata associated with restricted products without supplying the necessary access credentials. The risk implications include the unauthorized exposure of restricted catalog information, potentially violating confidentiality requirements for sensitive e-commerce inventories. Exploitation requires no prior authentication or special privileges, relying entirely on direct HTTP interactions with exposed AJAX handlers. Remediation requires updating the affected product to version 1.34.1 or later to ensure proper authorization checks are enforced across all search and details endpoints.",
  "technicalDetails": "The vulnerability resides in the unauthenticated AJAX endpoints implemented by the FiboSearch WordPress plugin, specifically affecting the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details. The root cause stems from insufficient backend validation and authorization checks regarding product visibility states. Specifically, the query generation logic fails to adequately filter out products marked as password-protected when processing requests from unauthenticated clients.\nDuring standard operation, the dgwt_wcas_ajax_search endpoint processes user input to return matching product suggestions via AJAX, while the dgwt_wcas_result_details endpoint retrieves extended product or taxonomy information. Because these endpoints are exposed to the public network interface without requiring session tokens or authentication credentials, any external user can issue crafted HTTP GET or POST requests to these handlers.\nThe attack flow proceeds as follows: An unauthenticated attacker targets the vulnerable AJAX actions by sending automated search queries or direct identifiers to the dgwt_wcas_ajax_search and dgwt_wcas_result_details endpoints. The underlying PHP functions process the requests using database queries that inadvertently omit post-password status verification. Consequently, the database returns restricted product records and associated metadata, such as titles, restricted URLs, snippets, and taxonomy details, which are then serialized and returned in the JSON response payload to the attacker.\nThis behavior bypasses the expected WordPress password challenge mechanism, which normally mandates that users submit a valid password before accessing the content of protected posts or products. The post-exploitation impact is constrained to information disclosure, enabling malicious actors to comprehensively harvest restricted catalog listings and metadata that should otherwise remain confidential."
}