{
 "id": "WPSEC-2026-1170",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1170/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1170/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1170/index.md",
 "title": "Better Search <= 4.5.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Thumbnails",
 "description": "The Better Search plugin for WordPress is vulnerable to Sensitive Information Exposure via search result thumbnails in all versions up to, and including, 4.5.1, due to the thumbnail fallback logic (content image scan and first attached image) processing password-protected posts without checking whether the post password had been entered. This makes it possible for unauthenticated attackers to view images embedded in or attached to password-protected posts through the thumbnails shown in search results, on sites where the default 'Exclude password protected posts' setting has been disabled.",
 "plugin": {
  "slug": "better-search",
  "name": "Better Search",
  "full_name": "Better Search – Relevant search results for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/better-search/",
  "advisories_url": "https://wpsec.com/vuln/plugin/better-search/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/better-search"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.2",
 "remediation": "Update to 4.5.2 or later.",
 "fix_released": "2026-10-16T09:04:24+00:00",
 "published": "2026-10-17T09:45:54+00:00",
 "updated": "2026-10-17T08:19:34.491754+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1170/",
  "https://plugins.svn.wordpress.org/better-search/tags/4.5.2/",
  "https://wordpress.org/plugins/better-search/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/better-search",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-17"
 }
}