CVE-2025-47444

FiboSearch <= 1.32.1 - Missing Authorization

mediumMissing Authorization

5.3

CVSS Score

5.3

CVSS Score

medium

Severity

1.32.2

Patched in

99d

Time to patch

Description

The FiboSearch plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.32.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

None

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=1.32.1

PublishedJanuary 7, 2026

Last updatedApril 15, 2026

Affected pluginajax-search-for-woocommerce

What Changed in the Fix

Changes introduced in v1.32.2

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v1.32.1

Browse source Download .zip

Patched v1.32.2

Browse source Download .zip

Research Plan

Unverified

# Exploitation Research Plan - CVE-2025-47444 ## 1. Vulnerability Summary **CVE-2025-47444** is a **Missing Authorization** vulnerability in the FiboSearch (Ajax Search for WooCommerce) plugin. The plugin exposes sensitive administrative functions—specifically related to the search index management…

Show full research plan

Exploitation Research Plan - CVE-2025-47444

1. Vulnerability Summary

CVE-2025-47444 is a Missing Authorization vulnerability in the FiboSearch (Ajax Search for WooCommerce) plugin. The plugin exposes sensitive administrative functions—specifically related to the search index management—to unauthorized users.

Based on the provided source code and assets/js/admin.js, the plugin utilizes several AJAX actions for indexing: dgwt_wcas_build_index, dgwt_wcas_stop_build_index, and dgwt_wcas_build_index_heartbeat. The vulnerability exists because the server-side handlers for these actions (likely located in includes/Admin/Troubleshooting.php or an Indexer class) fail to perform a current_user_can('manage_options') check. Furthermore, while the JavaScript code sends a nonce (_wpnonce), the server-side code may either fail to verify it or the action might be incorrectly registered using wp_ajax_nopriv_ or via the wc_ajax endpoint, which is public by default.

2. Attack Vector Analysis

Endpoint: wp-admin/admin-ajax.php OR /?wc-ajax=dgwt_wcas_build_index
Action: dgwt_wcas_build_index
Method: POST
Parameters:
- `

Research Findings

Static analysis — not yet PoC-verified

Summary

The FiboSearch plugin for WordPress is vulnerable to unauthorized access because it fails to perform capability and security nonce checks on administrative AJAX actions, specifically 'dgwt_wcas_index_details_toggle'. This allows unauthenticated attackers to perform unauthorized administrative actions by sending requests to the WordPress AJAX endpoint.

Vulnerable Code

// assets/js/admin.js line 421
                s.ajax({
                    url: ajaxurl,
                    type: 'post',
                    data: {
                        action: 'dgwt_wcas_index_details_toggle',
                        display: display
                    }
                });

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.1/ajax-search-for-woocommerce.php /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.2/ajax-search-for-woocommerce.php
--- /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.1/ajax-search-for-woocommerce.php	2025-12-16 10:07:08.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.2/ajax-search-for-woocommerce.php	2026-01-05 10:57:54.000000000 +0000
@@ -323,6 +323,7 @@
                         'stop_build_index'        => wp_create_nonce( 'dgwt_wcas_stop_build_index' ),
                         'build_index_heartbeat'   => wp_create_nonce( 'dgwt_wcas_build_index_heartbeat' ),
                         'advanced_options_switch' => wp_create_nonce( 'dgwt_wcas_advanced_options_switch' ),
+                        'index_details_toggle'    => wp_create_nonce( 'dgwt_wcas_index_details_toggle' ),
                     ],
                     'images'      => [
                         'admin_preloader_url' => DGWT_WCAS_URL . 'assets/img/preloader.gif',
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.1/assets/js/admin.js /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.2/assets/js/admin.js
--- /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.1/assets/js/admin.js	2025-11-15 10:17:14.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/ajax-search-for-woocommerce/1.32.2/assets/js/admin.js	2026-01-05 09:15:24.000000000 +0000
@@ -421,6 +421,7 @@
                     type: 'post',
                     data: {
                         action: 'dgwt_wcas_index_details_toggle',
+                        _wpnonce: dgwt_wcas.nonces.index_details_toggle,
                         display: display
                     }
                 });

Exploit Outline

An unauthenticated attacker can exploit this vulnerability by sending a POST request to '/wp-admin/admin-ajax.php' (or via the WooCommerce AJAX endpoint '/?wc-ajax=...') with the 'action' parameter set to 'dgwt_wcas_index_details_toggle'. Since versions up to 1.32.1 lack server-side capability verification (current_user_can) and security nonces for this handler, the request will be processed successfully, allowing the attacker to manipulate the 'display' state of search indexing details.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/243d7c43-9aef-44a6-a63a-862ff8881060?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database