Better Search EUVD-2026-116069

The description states only a Missing Authorization / incorrectly configured access-control-level flaw in Better Search through 4.5.2; it does not name the specific endpoint, AJAX/REST action, or feature that lacks the authorization check, so the exact trigger is not described in the available sources. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated and requires no user interaction against a network-reachable WordPress site running the affected plugin. The principal limiting factor is impact scope: C:L/I:N/A:N means an attacker gains only limited information disclosure, with no data modification or service disruption, and exposure is confined to sites actually running Better Search at version 4.5.2 or earlier.

This is a moderate-severity issue that should be scheduled rather than treated as an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates a network-reachable, low-complexity flaw requiring no privileges or user interaction, but with impact limited to low confidentiality only (no integrity or availability impact) - consistent with CWE-862 Missing Authorization exposing data that should be access-controlled. The vuln.today decision label is 'this_month', signalling a routine-priority patch cadence rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or imminent widespread exploitation; exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent: a genuine but limited information-exposure bug in a WordPress plugin, not a high-CVSS-but-overstated issue, yet also not a critical priority. Key gaps: EPSS is absent (cannot quantify exploitation probability), no fixed version is stated in the evidence, and the description does not name the specific vulnerable endpoint or feature - so the precise trigger cannot be confirmed from available sources.

A remote, unauthenticated attacker sends a crafted request to a Better Search plugin function that fails to enforce an authorization check, retrieving information that should be restricted (consistent with the low-confidentiality-only impact). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, special conditions, or victim interaction are required to reach the vulnerable code. No public exploit code was identified in the provided intelligence.