Better Search Replace CVE-2023-6933
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
AnalysisAI
PHP Object Injection in the Better Search Replace WordPress plugin (versions up to and including 1.4.4) allows remote unauthenticated attackers to inject arbitrary PHP objects through deserialization of untrusted input. While the plugin itself contains no POP chain, the presence of any additional plugin or theme on the same WordPress instance that introduces a usable POP gadget can escalate the bug to arbitrary file deletion, sensitive data disclosure, or remote code execution. Publicly available exploit code exists and the EPSS score of 93.40% (100th percentile) signals very high real-world exploitation probability.
Technical ContextAI
The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a well-known class of bug in PHP applications where calling unserialize() on attacker-controlled input lets the attacker instantiate arbitrary classes and trigger their magic methods (__wakeup, __destruct, __toString). The affected component is the Better Search Replace plugin by WP Engine (CPE cpe:2.3:a:wpengine:better_search_replace), a widely deployed WordPress utility used by administrators to perform bulk find-and-replace operations on the database, often after a site migration. Because WordPress runs many plugins and themes in one PHP process, any class autoloadable at request time becomes a potential gadget, which is why a 'gadget-less' object injection in one plugin is still dangerous in the typical WordPress ecosystem.
RemediationAI
Patch available per vendor advisory: upgrade Better Search Replace to the vendor-fixed release (version above 1.4.4, per the WP Engine/Wordfence advisories referenced from the CVE record) on every WordPress site where the plugin is installed, including staging and migration-only environments. If immediate patching is not possible, deactivate and uninstall the plugin since it is typically used only during one-off migrations and is not required for normal site operation - this fully removes the vulnerable endpoint with the trade-off that any in-progress search-replace workflow must be redone post-patch. As a compensating control, place the WordPress admin and the plugin's AJAX/admin-post endpoints behind an IP allow-list or WAF rule that blocks serialized PHP payloads (strings beginning with O: or a: in POST bodies targeting the plugin's actions), accepting the trade-off that legitimate admin requests carrying serialized data may be blocked. Audit the site for other installed plugins and themes that ship known POP gadget classes (e.g., older Monolog, Guzzle, PHPMailer, RIPS-documented WordPress gadgets) and prioritize removing or updating them, since they are what turns this primitive into full code execution.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Unauthenticated arbitrary file upload in the BookingPress Pro WordPress plugin (versions ≤5.6) enables remote code execu
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Share
External POC / Exploit Code
Leaving vuln.today