PT-2026-79508

CVE-2026-16612

Published

2026-08-22

Updated

2026-10-12

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FiboSearch versions prior to 1.34.1

Description The plugin fails to consistently exclude password-protected products from unauthenticated AJAX endpoints. This allows unauthenticated users to enumerate and disclose password-protected products and their associated metadata without providing the required password. The affected endpoints are 'dgwt wcas ajax search' (used for autocomplete search) and 'dgwt wcas result details' (used for the Details Panel when querying taxonomy details).

Recommendations Update FiboSearch to version 1.34.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Duy Tran

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers