# WP Fast Total Search <= 1.83.286 - Missing Authorization to Index Rebuild, Index Upgrade and Indexer Control via Multiple AJAX Actions

- **ID:** WPSEC-2026-2260
- **Plugin:** WP Fast Total Search – The Power of Indexed Search (`fulltext-search`), https://wordpress.org/plugins/fulltext-search/
- **Affected versions:** all versions before 1.84.291
- **Fixed in:** 1.84.291 (Update to 1.84.291 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fulltext-search
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2260/

## Description

The WP Fast Total Search plugin for WordPress is vulnerable to unauthorized access and modification of data via several AJAX actions (wpftsi_submit_rebuild, wpftsi_submit_upgradeindex, wpfts_force_index, wpftsi_ping and wpftsi_hide_notification) in all versions up to, and including, 1.83.286. This is due to missing capability checks on these handlers. Some had no nonce check either. The others relied only on nonces that the plugin printed in admin notices and in an inline admin script for any user who can open wp-admin. This makes it possible for authenticated attackers, with Subscriber-level access and above, to start the indexer, read the indexer and post index status, and dismiss the plugin's admin notices. When the plugin's database-update error notice or index-upgrade notice is shown, they can also rebuild the search index or flag index records for re-indexing.

## References

- https://wpsec.com/vuln/WPSEC-2026-2260/
- https://plugins.svn.wordpress.org/fulltext-search/tags/1.84.291/
- https://wordpress.org/plugins/fulltext-search/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2260/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.