CVE-2026-16612: CWE-200 Information Exposure in FiboSearch
Description
FiboSearch WordPress plugin versions before 1.34.1 have a vulnerability where unauthenticated AJAX endpoints expose password-protected products and their metadata without requiring the product password. This affects the autocomplete search and Details Panel endpoints, allowing unauthorized users to enumerate sensitive product information.
CVSS v3.1
Score 5.3medium
Affected software
FiboSearch
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The FiboSearch WordPress plugin prior to version 1.34.1 does not consistently exclude password-protected products from unauthenticated AJAX endpoints. Specifically, the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) can be queried to disclose and enumerate password-protected products and their metadata without authentication or entering the product password. This constitutes an information exposure vulnerability classified as CWE-200.
Potential Impact
Unauthenticated users can access and enumerate password-protected products and their metadata, potentially revealing sensitive product information that should be restricted. The vulnerability does not allow modification or denial of service but leaks confidential data.
Mitigation Recommendations
Upgrade FiboSearch to version 1.34.1 or later where this issue is fixed. No other mitigation is indicated. Patch status is confirmed by the version boundary in the affectedVersions field.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-22T14:35:43.427Z
- State
- PUBLISHED
Threat ID: 6a893cc5acd9273b49a6fe9a
Added to database: 08/22/2026, 06:08:05 UTC
Last enriched: 09/11/2026, 02:17:54 UTC
Last updated: 10/07/2026, 18:48:17 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.