WordPress Plugin Vulnerabilities

WP Fast Total Search < 1.79.262 - Missing Authorization

Description

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.78.258. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
fulltext-search
Fixed in 1.79.262

References

CVE
CVE-2025-24571
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/13aa1288-257a-417e-aad8-86075c9b9abe

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Kévin Mosbahi (Mika)
Verified
No
WPVDB ID
5467bf20-623d-4df1-bacf-191d7c6af4ca

Timeline

Publicly Published
2025-01-24 (about 1 year ago)
Added
2025-01-28 (about 1 year ago)
Last Updated
2025-01-28 (about 1 year ago)

Other

Published
Title
Published
2026-06-18
Title
WP DSGVO Tools (GDPR) < 3.1.40 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)
Published
2025-11-28
Title
Gutenverse Form < 2.3.0 - Missing Authorization
Published
2023-09-18
Title
Super Store Finder < 6.9.4 - Unauthenticated Email Creation/Sending
Published
2024-06-20
Title
WishList Member X < 3.26.7 - Missing Authorization to Information Disclosure
Published
2025-11-20
Title
Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.6 - Unauthenticated Presale Counter Update