Better Search Replace CVE-2023-6933

Exploitation requires the Better Search Replace plugin (version <=1.4.4) to be installed and active on the target WordPress site, an authenticated administrator to be tricked into visiting an attacker-controlled link or page (UI:R in the CVSS vector - the attacker themselves is unauthenticated, PR:N, but the request must originate from a privileged session via CSRF-style user interaction), and at least one additional plugin or theme on the same site that supplies a usable PHP Object Injection POP chain to convert object instantiation into file deletion, data disclosure, or code execution. Limiting factors are therefore: the plugin must be present (it is a migration utility, not always installed), an admin must perform the triggering interaction, and the host WordPress instance must contain at least one gadget-bearing component - on a hardened, minimal install with no exploitable gadget classes, impact is constrained to the object-injection primitive itself.

Signals converge strongly toward priority remediation: CVSS 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity exploitation by unauthenticated attackers with high impact across confidentiality, integrity, and availability, requiring only user interaction (UI:R). EPSS at 93.40% (100th percentile) combined with publicly available exploit code makes opportunistic mass exploitation realistic against the large WordPress install base. The vulnerability is not listed in CISA KEV at time of analysis, so 'confirmed active exploitation' cannot be asserted, but the combination of public POC, very high EPSS, and a popular plugin should be treated as a strong de facto exploitation signal. The one notable caveat is that real impact depends on a POP chain being present via another installed plugin or theme - on a minimal install with no gadget classes, the immediate impact is limited to the object injection primitive itself, which is why this should be assessed in context of the full plugin/theme footprint of each site.

An attacker hosts a malicious page or sends a crafted link to a logged-in WordPress administrator (UI:R); when the admin's browser triggers a request to the vulnerable Better Search Replace endpoint with a serialized PHP payload, the plugin calls unserialize() on attacker-controlled input and instantiates attacker-chosen classes. On a typical WordPress site with several plugins or themes loaded, a known POP gadget chain in one of those components is then triggered to delete files, exfiltrate database secrets, or achieve PHP code execution as the web user. Publicly available exploit code exists, lowering the skill barrier for opportunistic abuse.