CVE-2026-16612Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/705cf14a-2782-408a-80b1-be7a9da6bbdd/

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
3 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud45d
Disclosure
🚨*CVE* CVE-2026-16612 The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthentic… https://www.cve.org/CVERecord?id=CVE-2026-16612 ----- Traducción: CVE-2026-16612 El … http://infoflow.cloud`
Post summary
The post discloses CVE‑2026‑16612, a flaw in the FiboSearch WordPress plugin (versions < 1.34.1) that fails to filter password‑protected products from unauthenticated AJAX endpoints, potentially exposing sensitive data.
00000158
102 followersView on X
CVE@CVEnew45d
Patch
CVE-2026-16612 The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthentic… https://www.cve.org/CVERecord?id=CVE-2026-16612
Post summary
CVE-2026-16612 reveals that the FiboSearch WordPress plugin before version 1.34.1 allows unauthenticated access to password‑protected products via AJAX, and the issue is addressed in the 1.34.1 release.
00000786
58.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds45d
Disclosure
CVE-2026-16612 FiboSearch WordPress Plugin Unauthenticated Disclosure of Password-Protected Product Metadata https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16612
Post summary
A new vulnerability (CVE-2026-16612) in the FiboSearch WordPress plugin allows unauthenticated disclosure of password‑protected product metadata.
00000125
4.1K followersView on X

Explore more

Back to dashboard