The vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access control settings within the FiboSearch plugin. This flaw can enable unauthorized users to access functionality or data that should be restricted, potentially exposing sensitive content or allowing misuse of search features. The weakness is identified as a classic broken access control (CWE-862).

All installations of the WordPress FiboSearch plugin developed by Damian Gśóra, from the earliest releases up through version 1.32.1, are affected. No later versions are specified as vulnerable.

The CVSS score of 5.3 places the issue in the medium severity range, although the EPSS score of less than 1% indicates that the likelihood of exploitation is currently very low. The vulnerability is not listed in CISA’s KEV catalog. Based on the plugin’s nature, the likely attack vector involves web requests to the plugin’s endpoints; no explicit high‑level privileges are required to launch an exploit, but the lack of proper authentication checks allows attackers to use the features meant only for authorized users.