{"id":"CVE-2026-119495","kind":"vulnerability","aliases":["CVE-2026-119495"],"related":[],"title":"Better Search WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.","summary":"The Better Search WordPress plugin by WebberZone lacks an authorization check, so access controls can be bypassed when they are configured in certain ways. The sources affect all versions through 4.5.2.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["better-search","package","self-hosted","wordpress"],"not_affected_if":["default-config","plugin-not-installed"],"how_to_check":"- Check the installed Better Search plugin version in the WordPress admin plugins list; versions through `4.5.2` are listed as affected.\n- Confirm whether the site relies on Better Search access control settings.","fix":null,"status":"open","published_at":"2026-11-03T17:18:06+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:26+00:00","updated_at":"2026-11-03T17:24:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Better Search WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"The Better Search WordPress plugin by WebberZone lacks an authorization check, so access controls can be bypassed when they are configured in certain ways. The sources affect all versions through 4.5.2.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","better-search","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach access-controlled search content","analyst_note":"Check the NVD entry and the WebberZone advisory for the exact configuration, required privilege, and the fixed version.","how_to_check":"- Check the installed Better Search plugin version in the WordPress admin plugins list; versions through `4.5.2` are listed as affected.\n- Confirm whether the site relies on Better Search access control settings.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","default-config"],"who_is_affected":"Sites running the Better Search WordPress plugin at version 4.5.2 or earlier. The description says exposure depends on access control security levels being configured, so sites using default settings may be less exposed. The sources do not say which configuration triggers the flaw.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":4100,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119495':13A,16A '-2026':12A,15A '4.5.2':55B,81C 'access':9A,37B,70C 'affect':51B,75C 'allow':66C 'author':6A,34B,57C 'better':1A,18B,26B,61C,64C,76C 'better-search':17B,63C 'bypass':41B 'certain':47B 'check':7A,35B 'configur':45B,69C 'control':10A,38B,71C 'cve':11A,14A 'exploit':67C 'expos':8A 'host':23B 'incorrect':68C 'issu':74C 'lack':32B 'levels.this':73C 'miss':5A,56C 'n/a':79C 'packag':20B 'plugin':4A,29B 'search':2A,19B,27B,62C,65C,77C 'secur':72C 'self':22B 'self-host':21B 'sourc':50B 'version':53B 'vulner':58C 'way':48B 'webberzon':31B,60C 'wordpress':3A,24B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Better Search WordPress plugin at version 4.5.2 or earlier. The description says exposure depends on access control security levels being configured, so sites using default settings may be less exposed. The sources do not say which configuration triggers the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bettersearch","medium","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T17:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119495","severity":null,"published_at":"2026-11-03T17:18:06+00:00","modified_at":"2026-11-03T17:18:06+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}