Published: 05/02/2024 Updated: 14/02/2024

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated malicious users to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the malicious user to delete arbitrary files, retrieve sensitive data, or execute code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
wpengine better search replace

Introduction to CVE-2023-6933 Vulnerability

Introduction to CVE-2023-6933 Vulnerability Description The "Better Search Replace" plugin for WordPress exhibits a critical vulnerability known as PHP Object Injection This security flaw is present in all versions up to and including 144 It arises from the deserialization of untrusted input, enabling unauthenticated attackers to inject a PHP Object into the syst

CWE-502 https://www.wordfence.com/threat-intel/vulnerabilities/id/895f2db1-a2ed-4a17-a4f6-cd13ee8f84af?source=cve https://plugins.trac.wordpress.org/browser/better-search-replace/trunk/includes/class-bsr-db.php#L334 https://plugins.trac.wordpress.org/changeset/3023674/better-search-replace/trunk/includes/class-bsr-db.php https://nvd.nist.gov https://github.com/w2xim3/CVE-2023-6933

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-6933

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect