---
id: "CVE-2026-119495"
kind: "vulnerability"
aliases: ["CVE-2026-119495"]
title: "Better Search WordPress plugin: missing authorization check exposes access control"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["better-search", "package", "self-hosted", "wordpress"]
not_affected_if: ["default-config", "plugin-not-installed"]
published_at: "2026-11-03T17:18:06+00:00"
first_seen_at: "2026-11-03T17:21:55+00:00"
updated_at: "2026-11-03T17:24:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119495", "first_seen_at": "2026-11-03T17:21:55+00:00"}]
---

# Better Search WordPress plugin: missing authorization check exposes access control

The Better Search WordPress plugin by WebberZone lacks an authorization check, so access controls can be bypassed when they are configured in certain ways. The sources affect all versions through 4.5.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Better Search plugin version in the WordPress admin plugins list; versions through `4.5.2` are listed as affected.
- Confirm whether the site relies on Better Search access control settings.

## Timeline

- 2026-11-03T17:21:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119495

## From the sources

Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_