CVE-2026-16612 — FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users …
Published: 2026-08-22 · CVSS: 5.3 · CVSS 3.1
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7