What the vulnerability does
01Description
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
Better Search Replace versions up to 1.4.4 contain a deserialization vulnerability that allows attackers to execute arbitrary code on the site. An attacker can craft a malicious serialized object and trick a site user into visiting a specially crafted link. If successful, the attacker gains full control over the WordPress installation.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site and take full control of WordPress.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site, including data theft, malware installation, and site defacement.
Conditions required to exploit
05Prerequisites
A site user must visit an attacker-controlled link or page containing the malicious payload.
Key dates
06Disclosure timeline
February 5, 2024
CVE published
April 8, 2026
Record updated
