WP Fast Total Search <= 1.83.286 - Missing Authorization to Index Rebuild, Index Upgrade and Indexer Control via Multiple AJAX Actions
- ID
- WPSEC-2026-2260
- Plugin
- WP Fast Total Search – The Power of Indexed Search (fulltext-search)
- Affected
- all versions before 1.84.291
- Remediation
- Update to 1.84.291 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WP Fast Total Search on WPSec AttackSurface
- Fix released
- Published
Description
The WP Fast Total Search plugin for WordPress is vulnerable to unauthorized access and modification of data via several AJAX actions (wpftsi_submit_rebuild, wpftsi_submit_upgradeindex, wpfts_force_index, wpftsi_ping and wpftsi_hide_notification) in all versions up to, and including, 1.83.286. This is due to missing capability checks on these handlers. Some had no nonce check either. The others relied only on nonces that the plugin printed in admin notices and in an inline admin script for any user who can open wp-admin. This makes it possible for authenticated attackers, with Subscriber-level access and above, to start the indexer, read the indexer and post index status, and dismiss the plugin's admin notices. When the plugin's database-update error notice or index-upgrade notice is shown, they can also rebuild the search index or flag index records for re-indexing.
References
- https://wpsec.com/vuln/WPSEC-2026-2260/
- https://plugins.svn.wordpress.org/fulltext-search/tags/1.84.291/
- https://wordpress.org/plugins/fulltext-search/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS