CVE-2026-16612

Name of the Vulnerable Software and Affected Versions FiboSearch versions prior to 1.34.1

Description The plugin fails to consistently exclude password-protected products from unauthenticated AJAX endpoints. This allows unauthenticated users to enumerate and disclose password-protected products and their associated metadata without providing the required password. The affected endpoints are 'dgwt wcas ajax search' (used for autocomplete search) and 'dgwt wcas result details' (used for the Details Panel when querying taxonomy details).

Recommendations Update FiboSearch to version 1.34.1 or later.