CVE-2025-24571: WP Fast Total Search Auth Bypass Vulnerability

CVE-2025-24571 Overview

CVE-2025-24571 is a missing authorization vulnerability in the Epsiloncool WP Fast Total Search (fulltext-search) plugin for WordPress. The flaw affects all versions up to and including 1.78.258. Authenticated attackers with low-level privileges can exploit incorrectly configured access control security levels to reach functionality that should be restricted. The weakness is tracked as CWE-862: Missing Authorization.

Critical Impact
An authenticated attacker with minimal privileges can access restricted plugin functionality, affecting integrity and availability of the WordPress site.

Affected Products

Epsiloncool WP Fast Total Search (fulltext-search) WordPress plugin
All versions from unspecified initial release through 1.78.258
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-01-24 - CVE-2025-24571 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24571

Vulnerability Analysis

The WP Fast Total Search plugin exposes functionality without enforcing proper authorization checks. The plugin fails to validate whether the requesting user holds the capability required for a given action. As a result, users with low privilege levels, such as subscribers, can invoke restricted operations.

The impact is limited to integrity and availability. Confidentiality is not affected according to the published CVSS vector. Attackers can modify plugin state or trigger operations that disrupt search functionality on the affected WordPress site.

Root Cause

The root cause is the absence of capability checks on one or more plugin endpoints or actions. WordPress plugins are expected to enforce authorization using functions such as current_user_can() and to validate nonces on state-changing requests. When these checks are missing, any authenticated session can reach protected functionality regardless of assigned role.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privilege account. No user interaction is needed. The attacker sends crafted HTTP requests to the vulnerable plugin endpoints, invoking actions that should be gated by a higher role. Refer to the Patchstack Vulnerability Report for advisory details.

No public proof-of-concept exploit is currently listed for this CVE, and it is not tracked in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.455%.

Detection Methods for CVE-2025-24571

Indicators of Compromise

Unexpected HTTP POST or GET requests to fulltext-search plugin endpoints originating from subscriber-level or newly registered accounts.
WordPress admin-ajax.php or REST API calls referencing the plugin's actions from non-administrative user sessions.
Anomalous changes to search index state, plugin settings, or content associated with the plugin.

Detection Strategies

Enable WordPress audit logging to capture authenticated actions, correlating user role against invoked plugin endpoints.
Deploy a Web Application Firewall (WAF) rule that flags requests to fulltext-search action names from users lacking administrative capabilities.
Baseline normal plugin traffic and alert on request bursts from single accounts targeting plugin endpoints.

Monitoring Recommendations

Monitor plugin version inventory and alert when instances of fulltext-search at version 1.78.258 or earlier are detected.
Track new low-privilege account registrations followed by unusual API activity within short time windows.
Forward WordPress and web server access logs to a centralized SIEM for correlation and long-term retention.

How to Mitigate CVE-2025-24571

Immediate Actions Required

Identify all WordPress instances running the WP Fast Total Search (fulltext-search) plugin and confirm versions.
Update the plugin to a version later than 1.78.258 once the vendor publishes a fix, or disable the plugin if no patched version is available.
Review WordPress user accounts and remove or downgrade unused low-privilege accounts that could be leveraged for exploitation.

Patch Information

The vulnerability affects WP Fast Total Search through 1.78.258. Administrators should consult the Patchstack Vulnerability Report for the latest fixed version and vendor guidance. Apply updates promptly through the WordPress plugin dashboard or via wp-cli.

Workarounds

Deactivate and remove the fulltext-search plugin until a patched release is verified.
Restrict access to wp-admin/admin-ajax.php and REST API endpoints associated with the plugin using WAF rules that require administrative capabilities.
Disable open user registration or require administrator approval for new accounts to reduce the pool of authenticated attackers.

bash

# Configuration example: identify and disable the vulnerable plugin using wp-cli
wp plugin list --name=fulltext-search --fields=name,status,version
wp plugin deactivate fulltext-search
wp plugin delete fulltext-search