Wp Fast Total Search
Monthly
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
SQL injection in the WP Fast Total Search (fulltext-search) WordPress plugin by epsiloncool affects all versions up to and including 1.80.280, letting unauthenticated remote attackers inject arbitrary SQL into backend queries (CWE-89). Because the CVSS vector uses PR:N/UI:N with a scope change, exploitation needs no login or user interaction and can reach data beyond the plugin's own tables. No public exploit was identified at time of analysis; the issue was reported through Patchstack and carries a critical 9.3 base score.
Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
SQL injection in the WP Fast Total Search (fulltext-search) WordPress plugin by epsiloncool affects all versions up to and including 1.80.280, letting unauthenticated remote attackers inject arbitrary SQL into backend queries (CWE-89). Because the CVSS vector uses PR:N/UI:N with a scope change, exploitation needs no login or user interaction and can reach data beyond the plugin's own tables. No public exploit was identified at time of analysis; the issue was reported through Patchstack and carries a critical 9.3 base score.
Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.