Executive brief
FiboSearch is a WooCommerce search plugin that helps customers find products on WordPress-based e-commerce sites. The plugin failed to consistently block access to password-protected products from its search endpoints, allowing anyone to view and list protected product details (name, price, image, description) without entering the product password. An attacker can enumerate all password-protected products and their metadata, bypassing the intended access restrictions and leaking sensitive product information.
Technical details
The vulnerability is an information disclosure flaw in the FiboSearch WordPress plugin affecting versions before 1.34.1. Two AJAX endpoints fail to properly exclude password-protected products: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details). The root cause is inconsistent application of password-protection filters—in v1.34.0, the exclusion condition was dropped when no search phrase was provided. An unauthenticated attacker can make direct AJAX requests to enumerate password-protected products and retrieve their metadata (title, URL, thumbnail, price, SKU, description) without authentication. The product permalinks remain protected (showing a password form on access), but metadata leaks through search results. The fix in v1.34.1 applies a standalone post-query filter to ensure password-protected products are excluded regardless of query parameters.
Affected products
- FiboSearch FiboSearch before 1.34.1
Timeline
- 2026-08-20: disclosed
- 2026-08-22: patched: Fixed in version 1.34.1