WordPress Better Search plugin suffers from a broken access control flaw, allowing unauthenticated users to bypass authorization checks. The vulnerability enables attackers to read or modify protected data and features that should be restricted to users with appropriate permissions. This flaw is classified as CWE-862, highlighting improper handling of access rights.

Systems affected are WordPress sites using WebberZone's Better Search plugin version 4.5.2 or older. The flaw is present from the earliest release through 4.5.2, so any site still running those versions is vulnerable. Site owners should verify the plugin version and plan an upgrade.

Though the CVSS score of 5.3 indicates moderate severity and no EPSS data is available, the vulnerability remains exploitable by any external actor capable of reaching the plugin’s endpoints. The plugin’s lack of remote authentication permits exploitation over the public web interface, suggesting a typical web‑application attack vector. As the flaw is not listed in the CISA KEV catalog, there is currently no evidence of widespread exploitation, but the risk warrants timely remediation.