CVE-2025-30894: WP Fast Total Search Auth Bypass Flaw

CVE-2025-30894 Overview

CVE-2025-30894 is a missing authorization vulnerability in the Epsiloncool WP Fast Total Search (fulltext-search) WordPress plugin. The flaw affects all versions up to and including 1.79.262. It stems from incorrectly configured access control on plugin functionality, allowing authenticated low-privilege users to invoke actions that should be restricted. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with low privileges can bypass access controls on the WP Fast Total Search plugin, resulting in limited integrity impact on affected WordPress sites.

Affected Products

Epsiloncool WP Fast Total Search plugin for WordPress
Versions from unspecified initial release through 1.79.262
WordPress sites with the fulltext-search plugin installed and activated

Discovery Timeline

2025-03-27 - CVE-2025-30894 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30894

Vulnerability Analysis

The vulnerability is a broken access control issue in the WP Fast Total Search plugin. The plugin exposes functionality without verifying that the requesting user holds the appropriate capability or role. An attacker with a low-privilege authenticated account can invoke these actions and modify plugin-controlled data or behavior.

The defect maps to CWE-862, which describes software that does not perform an authorization check when an actor attempts to access a resource or perform an action. In WordPress plugins, this pattern typically appears in AJAX action handlers or REST endpoints that omit current_user_can() checks.

The CVSS vector indicates a network-reachable attack requiring low privileges and no user interaction, with a limited impact on integrity only. Confidentiality and availability are not directly impacted according to the assigned metrics.

Root Cause

The root cause is the absence of capability or role verification on one or more plugin actions. Authorization logic is either missing or misconfigured, allowing any authenticated user, regardless of role, to reach protected functionality.

Attack Vector

Exploitation requires a valid WordPress account on the target site. Once authenticated, the attacker issues an HTTP request to the vulnerable plugin action. Because no authorization check gates the handler, the request executes and modifies plugin state. Refer to the Patchstack advisory for technical specifics.

No public proof-of-concept exploit code has been released. The EPSS probability is 0.319%, placing it in the 24th percentile for likelihood of exploitation.

Detection Methods for CVE-2025-30894

Indicators of Compromise

Unexpected changes to WP Fast Total Search plugin settings or indexed content
HTTP POST requests to admin-ajax.php or plugin REST endpoints originating from low-privilege user sessions
Subscriber or contributor accounts issuing requests to plugin actions normally reserved for administrators

Detection Strategies

Audit WordPress access logs for requests to fulltext-search plugin endpoints from non-administrative user roles
Enable WordPress action logging plugins to record plugin-level configuration and data changes
Monitor for anomalous authenticated request patterns targeting plugin AJAX or REST routes

Monitoring Recommendations

Track the installed version of the WP Fast Total Search plugin across all WordPress instances
Alert on the creation of low-privilege accounts followed by requests to plugin management endpoints
Review the Patchstack vulnerability database for updated indicators or patch availability

How to Mitigate CVE-2025-30894

Immediate Actions Required

Identify all WordPress sites running the WP Fast Total Search (fulltext-search) plugin
Deactivate the plugin on any instance running version 1.79.262 or earlier until a fixed version is confirmed
Review WordPress user accounts and remove unused low-privilege accounts that could be leveraged for exploitation
Enforce strong authentication and account registration controls to limit attacker access to authenticated endpoints

Patch Information

At the time of publication, no vendor-confirmed patched version is listed in the CVE record. Administrators should consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for updates beyond version 1.79.262.

Workarounds

Deactivate and remove the WP Fast Total Search plugin until an updated version addressing the missing authorization is confirmed
Restrict access to wp-admin/admin-ajax.php and plugin REST endpoints at the web application firewall layer for non-administrative roles
Disable open user registration or restrict new registrations to trusted email domains to reduce the pool of authenticated attackers

bash

# Example: disable open registration in wp-config.php by setting the option via WP-CLI
wp option update users_can_register 0

# Example: deactivate the vulnerable plugin
wp plugin deactivate fulltext-search