Read the docs
TI-2022-01346 Aliases CVE-2022-1472GHSA-g8rq-2pr5-2p4w

Better Find and Replace < 1.3.6 - Admin+ SQLi

Priority LOW 34CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection

Why it matters now

EPSS 0.01255 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Better Find and Replace (Unknown): 1.3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownBetter Find and Replace1.3.6 to before 1.3.61.3.6Patch availableCNA
  • Better Find and Replace VendorUnknown Affected 1.3.6 to before 1.3.6 Fixed in 1.3.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codesolz:better_find_and_replace:*:*:*:*:*:wordpress:*:*before 1.3.6VulnerableCodeSolz
  • cpe:2.3:a:codesolz:better_find_and_replace:*:*:*:*:*:wordpress:*:* Versions before 1.3.6 Vulnerable ·CodeSolz

Remediation

  • Fix · CNA Better Find and Replace (Unknown) Fixed in 1.3.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1472
  2. 2026-10-03 Alias added: GHSA-g8rq-2pr5-2p4w

References

Exploit 1

  • TI-2021-06958 Better Find and Replace < 1.2.9 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences