CVE-2026-16612

The key to this CVE isn't the access control failure itself but what it reveals about WooCommerce's password protection model and how third-party plugins interact with it. FiboSearch's autocomplete and product details endpoints return metadata for password-protected products because WooCommerce's protection applies at render time, not at query time. When AJAX endpoints fetch product data, the password check hasn't happened yet—it's a fundamental architectural mismatch that the plugin ecosystem consistently gets wrong. What's actually exposed matters more than the CVSS 5.3 suggests. These aren't just unpurchased products—they're deliberately hidden merchandise: unreleased items, wholesale catalogs, age-restricted products, B2B pricing structures. Enumerating their existence and taxonomy relationships without authentication exposes business intelligence the merchant intended to keep private. A competitor or media outlet could map an entire hidden product roadmap from this data. The CVSS treats this as informational disclosure; the reality is industrial espionage fuel. The 'inconsistent exclusion' language in the CVE is diagnostic, not descriptive. It tells you FiboSearch developers knew protection was required and attempted implementation—but the protection logic breaks differently across endpoints because WooCommerce gives plugins no reliable hook to check password-protection state during AJAX operations. Different code vintages, different developers, same blind spot. That's why this will recur in other plugins. Check your FiboSearch version: 1.34.1 contains the fix. But the architectural problem extends beyond this plugin—any search or indexing extension querying WooCommerce products faces the same temporal gap between query time and protection application. Audit other AJAX-enabled product features in your stack. And understand that this isn't just a technical vulnerability: it's a business intelligence leak with real-world value to competitors, and the CVSS score badly understates that.

Reviewed through automated stages and approved by a human before publication.