{
 "id": "WPSEC-2026-2260",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2260/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2260/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2260/index.md",
 "title": "WP Fast Total Search <= 1.83.286 - Missing Authorization to Index Rebuild, Index Upgrade and Indexer Control via Multiple AJAX Actions",
 "description": "The WP Fast Total Search plugin for WordPress is vulnerable to unauthorized access and modification of data via several AJAX actions (wpftsi_submit_rebuild, wpftsi_submit_upgradeindex, wpfts_force_index, wpftsi_ping and wpftsi_hide_notification) in all versions up to, and including, 1.83.286. This is due to missing capability checks on these handlers. Some had no nonce check either. The others relied only on nonces that the plugin printed in admin notices and in an inline admin script for any user who can open wp-admin. This makes it possible for authenticated attackers, with Subscriber-level access and above, to start the indexer, read the indexer and post index status, and dismiss the plugin's admin notices. When the plugin's database-update error notice or index-upgrade notice is shown, they can also rebuild the search index or flag index records for re-indexing.",
 "plugin": {
  "slug": "fulltext-search",
  "name": "WP Fast Total Search",
  "full_name": "WP Fast Total Search – The Power of Indexed Search",
  "wordpress_org": "https://wordpress.org/plugins/fulltext-search/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fulltext-search/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fulltext-search"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.84.291",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.84.291"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.84.291",
 "remediation": "Update to 1.84.291 or later.",
 "fix_released": "2026-11-01T05:53:14+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:21:55.477932+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2260/",
  "https://plugins.svn.wordpress.org/fulltext-search/tags/1.84.291/",
  "https://wordpress.org/plugins/fulltext-search/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fulltext-search",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}