wpengine Better Search Replace vulnerabilities

Latest wpengine Better Search Replace CVEs

Newest publication first

1. CVE-2023-6933 Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

   Published 2024-02-05

   Critical·CVSS 9.8

   The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vul...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.