What is the CVSS score of CVE-2023-6933?

CVE-2023-6933 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 93.4%.

Which versions of Better Search Replace are affected by CVE-2023-6933?

Better Search Replace WordPress plugin (CVE-2023-6933) contains a PHP object injection vulnerability exploitable by unauthenticated remote attackers.. A patch is available.

Is there a public PoC exploit available for CVE-2023-6933?

Yes, a public proof-of-concept exploit is available for CVE-2023-6933. Prioritise patching immediately. EPSS: 93.4%.

How to fix or mitigate CVE-2023-6933?

Within 24 hours: Identify all WordPress instances with Better Search Replace plugin version 1.4.4 or earlier installed. Within 7 days: Apply patch available per vendor advisory to all affected instances and verify installation. Within 30 days: Audit other deployed plugins for known gadget chains and establish timely patching procedures.

Better Search Replace CVE-2023-6933

HIGH

Deserialization of Untrusted Data (CWE-502)

2024-02-05 security@wordfence.com

PHP Deserialization WordPress Information Disclosure Better Search Replace

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 08, 2026 - 18:22 nvd

Patch available

PoC Detected

Apr 08, 2026 - 18:18 vuln.today

Public exploit code

CVE Published

Feb 05, 2024 - 22:15 nvd

HIGH 8.8

DescriptionCVE.org

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

AnalysisAI

PHP Object Injection in the Better Search Replace WordPress plugin (versions up to and including 1.4.4) allows remote unauthenticated attackers to inject arbitrary PHP objects through deserialization of untrusted input. While the plugin itself contains no POP chain, the presence of any additional plugin or theme on the same WordPress instance that introduces a usable POP gadget can escalate the bug to arbitrary file deletion, sensitive data disclosure, or remote code execution. Publicly available exploit code exists and the EPSS score of 93.40% (100th percentile) signals very high real-world exploitation probability.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a well-known class of bug in PHP applications where calling unserialize() on attacker-controlled input lets the attacker instantiate arbitrary classes and trigger their magic methods (__wakeup, __destruct, __toString). The affected component is the Better Search Replace plugin by WP Engine (CPE cpe:2.3:a:wpengine:better_search_replace), a widely deployed WordPress utility used by administrators to perform bulk find-and-replace operations on the database, often after a site migration. Because WordPress runs many plugins and themes in one PHP process, any class autoloadable at request time becomes a potential gadget, which is why a 'gadget-less' object injection in one plugin is still dangerous in the typical WordPress ecosystem.

RemediationAI

Patch available per vendor advisory: upgrade Better Search Replace to the vendor-fixed release (version above 1.4.4, per the WP Engine/Wordfence advisories referenced from the CVE record) on every WordPress site where the plugin is installed, including staging and migration-only environments. If immediate patching is not possible, deactivate and uninstall the plugin since it is typically used only during one-off migrations and is not required for normal site operation - this fully removes the vulnerable endpoint with the trade-off that any in-progress search-replace workflow must be redone post-patch. As a compensating control, place the WordPress admin and the plugin's AJAX/admin-post endpoints behind an IP allow-list or WAF rule that blocks serialized PHP payloads (strings beginning with O: or a: in POST bodies targeting the plugin's actions), accepting the trade-off that legitimate admin requests carrying serialized data may be blocked. Audit the site for other installed plugins and themes that ship known POP gadget classes (e.g., older Monolog, Guzzle, PHPMailer, RIPS-documented WordPress gadgets) and prioritize removing or updating them, since they are what turns this primitive into full code execution.