Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-9334
- 2026-10-03 Alias added: GHSA-2mx4-g8fr-m5m8
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/232f3a15-3bd3-44fa-aa07-f055e8fcda88?source=cve
- https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php#L29
- https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/lib/Util.php#L233
- https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/admin/functions/DbReplacer.php#L507
- https://plugins.trac.wordpress.org/changeset/3389979/
More CodeSolz vulnerabilities
- TI-2025-19473 SQL injection in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce CVSS 3.1CRITICAL 9.3
- TI-2025-18451 WordPress Better Find and Replace plugin <= 1.6.7 - Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
- TI-2024-26560 WordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerability CVSS 3.1HIGH 8.3
- TI-2025-22724 WordPress Ultimate Push Notifications plugin <= 1.2.0 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
- TI-2022-01346 Better Find and Replace < 1.3.6 - Admin+ SQLi CVSS 3.1HIGH 7.2
- TI-2025-22711 WordPress Ultimate Push Notifications plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
Sources
- CVE-2025-9334 · CVE Program
- CVE-2025-9334 · NVD
- FIRST EPSS
- GHSA-2mx4-g8fr-m5m8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences