CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost.
Explanation of Vulnerability in Simple Terms
Better Find and Replace versions up to 1.7.7 contain an improper access control vulnerability that allows authenticated users to modify data they should not have permission to change. The vulnerability requires a valid user account and network access but no additional user interaction. Site administrators should update to a version newer than 1.7.7 to remediate this issue.
What an attacker can do
Modify data or settings without proper authorization.
Potential impact on your site
Unauthorized users with basic accounts can alter plugin data or settings.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges.
Key dates
External resources
