CVE-2026-16612 Overview
CVE-2026-16612 is an information disclosure vulnerability in the FiboSearch WordPress plugin versions before 1.34.1. The plugin fails to consistently exclude password-protected WooCommerce products from its unauthenticated AJAX endpoints. Unauthenticated attackers can enumerate and disclose password-protected products and their metadata without providing the product password. Two endpoints are affected: the autocomplete search endpoint dgwt_wcas_ajax_search and the Details Panel endpoint dgwt_wcas_result_details when queried for taxonomy details. The flaw is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].
Critical Impact
Unauthenticated attackers can bypass WooCommerce product password protection to enumerate and read metadata for restricted products through public AJAX endpoints.
Affected Products
- FiboSearch WordPress plugin versions before 1.34.1
- WooCommerce stores using FiboSearch with password-protected products
- WordPress sites exposing the affected AJAX endpoints
Discovery Timeline
- 2026-08-22 - CVE-2026-16612 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-16612
Vulnerability Analysis
FiboSearch provides AJAX-driven product search and detail panels for WooCommerce storefronts. WordPress supports password protection on individual posts and products, requiring users to submit a password before viewing content. FiboSearch does not apply this protection consistently across its unauthenticated endpoints. Attackers can query the search or details endpoints and receive data belonging to password-protected products. The disclosed metadata may include product titles, taxonomy terms, categories, tags, and other attributes intended to remain confidential until password entry.
Root Cause
The plugin's filtering logic for the dgwt_wcas_ajax_search and dgwt_wcas_result_details endpoints does not check the password-protection status of returned items. When the Details Panel is queried for taxonomy details, the code path bypasses access checks that would otherwise exclude protected products. This is a broken access control failure resulting in information disclosure rather than a memory or injection flaw.
Attack Vector
The attack requires no authentication and no user interaction. An attacker sends crafted HTTP POST requests to the WordPress admin-ajax.php handler, targeting the two vulnerable actions. The autocomplete endpoint returns matching product entries regardless of password protection. The details endpoint returns taxonomy metadata for protected products when queried. Attackers can iterate query terms to enumerate the full catalog of restricted products. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-16612
Indicators of Compromise
- High-volume unauthenticated POST requests to /wp-admin/admin-ajax.php with action=dgwt_wcas_ajax_search
- Repeated requests to admin-ajax.php with action=dgwt_wcas_result_details requesting taxonomy details
- Sequential or dictionary-style query parameters suggesting product enumeration
- Traffic from single IPs or distributed sources iterating alphabetic search terms
Detection Strategies
- Review web server access logs for the two AJAX actions originating from unauthenticated sessions
- Correlate request volume against baseline search traffic to identify enumeration spikes
- Inspect WordPress access logs for repeated queries matching titles or slugs of password-protected products
- Deploy web application firewall rules that flag anomalous request rates against admin-ajax.php
Monitoring Recommendations
- Enable request logging with query parameters for admin-ajax.php handlers
- Alert on burst traffic to dgwt_wcas_ajax_search exceeding normal storefront usage
- Track response sizes on dgwt_wcas_result_details to identify data exfiltration patterns
- Monitor for scraping user-agents and automated tooling accessing search endpoints
How to Mitigate CVE-2026-16612
Immediate Actions Required
- Upgrade FiboSearch to version 1.34.1 or later on all affected WordPress installations
- Audit WooCommerce product catalog for password-protected items and confirm exposure risk
- Review server access logs for prior enumeration attempts against the affected AJAX actions
- Apply web application firewall rules to rate-limit unauthenticated requests to admin-ajax.php
Patch Information
The vendor addressed the vulnerability in FiboSearch 1.34.1 by consistently excluding password-protected products from both dgwt_wcas_ajax_search and dgwt_wcas_result_details responses. Site administrators should update through the WordPress plugin manager or replace the plugin files with the patched release. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Temporarily disable the FiboSearch plugin until the update to 1.34.1 can be applied
- Restrict access to admin-ajax.php actions dgwt_wcas_ajax_search and dgwt_wcas_result_details via WAF rules
- Remove password protection from products and use role-based access control if immediate patching is not possible
- Move sensitive products to a separate, access-restricted WooCommerce store instance
# Example WAF rule to block the vulnerable AJAX actions until patched
# ModSecurity example
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1026016612,msg:'Block FiboSearch AJAX pre-patch'"
SecRule ARGS:action "@rx ^(dgwt_wcas_ajax_search|dgwt_wcas_result_details)$"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
