CVE-2025-9334

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9334", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-21T23:29:44.529Z", "datePublished": "2025-11-08T05:52:43.249Z", "dateUpdated": "2026-04-08T16:41:53.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:53.286Z"}, "affected": [{"vendor": "codesolz", "product": "Better Find and Replace \u2013 AI-Powered Suggestions", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Better Find and Replace \u2013 AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions."}], "title": "Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/232f3a15-3bd3-44fa-aa07-f055e8fcda88?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php#L29"}, {"url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/lib/Util.php#L233"}, {"url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/admin/functions/DbReplacer.php#L507"}, {"url": "https://plugins.trac.wordpress.org/changeset/3389979/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "ISMAILSHADOW"}], "timeline": [{"time": "2025-10-28T04:23:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T18:45:28.646757Z", "id": "CVE-2025-9334", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:12:37.316Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9334", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-10T18:45:28.646757Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:09:14.004Z"}}], "cna": {"title": "Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection", "credits": [{"lang": "en", "type": "finder", "value": "ISMAILSHADOW"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "codesolz", "product": "Better Find and Replace \u2013 AI-Powered Suggestions", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.7.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-28T04:23:42.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/232f3a15-3bd3-44fa-aa07-f055e8fcda88?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php#L29"}, {"url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/lib/Util.php#L233"}, {"url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/admin/functions/DbReplacer.php#L507"}, {"url": "https://plugins.trac.wordpress.org/changeset/3389979/"}], "descriptions": [{"lang": "en", "value": "The Better Find and Replace \u2013 AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-08T05:52:43.249Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9334", "state": "PUBLISHED", "dateUpdated": "2025-11-10T19:12:37.316Z", "dateReserved": "2025-08-21T23:29:44.529Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T05:52:43.249Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Better Find and Replace \u2013 AI-Powered Suggestions", "vendor": "codesolz", "versions": [{"lessThanOrEqual": "1.7.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Better Find and Replace \u2013 AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions."}, {"lang": "es", "value": "El plugin Better Find and Replace - AI-Powered Suggestions para WordPress es vulnerable a Inyecci\u00f3n de C\u00f3digo Limitada en todas las versiones hasta e incluyendo la 1.7.7. Esto se debe a una validaci\u00f3n de entrada y restricci\u00f3n insuficientes en la funci\u00f3n 'rtafar_ajax'. Esto permite a atacantes autenticados, con acceso de nivel Suscriptor y superior, llamar a funciones arbitrarias del plugin y ejecutar c\u00f3digo dentro de esas funciones."}], "id": "CVE-2025-9334", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9334", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-10T18:45:28.646757Z", "version": "2.0.3"}}]}, "published": "2025-11-08T06:15:41.270", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php#L29"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/admin/functions/DbReplacer.php#L507"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/lib/Util.php#L233"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3389979/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/232f3a15-3bd3-44fa-aa07-f055e8fcda88?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:57:45.785060+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to the latest version (1.7.8 or newer) where the issue has been fixed.", "If an upgrade is not immediately possible, limit access to the rtafar_ajax endpoint to administrators only or remove the endpoint entirely.", "Review user roles and reduce the number of subscriber accounts or downgrade them to lower roles to shrink the attack surface.", "Consider disabling or uninstalling the plugin if it is no longer essential to your operations."], "summary": {"action": "Apply Patch", "impact": "Limited Code Injection"}, "threat_synthesis": {"affected_systems": "The issue impacts all versions of the Better Find and Replace \u2013 AI\u2011Powered Suggestions plugin released by codesolz up to and including 1.7.7. Any installation using a version equal to or lower than 1.7.7 is affected; versions beyond 1.7.7 are not impacted.", "description_and_impact": "The Better Find and Replace \u2013 AI-Powered Suggestions plugin for WordPress is vulnerable to limited code injection through the rtafar_ajax function. The flaw stems from insufficient input validation and a lack of restrictions, allowing an authenticated user with at least subscriber privileges to invoke arbitrary plugin functions and execute code within those functions. This weakness is a classic code injection scenario (CWE\u201194) and can lead to remote code execution on the server if the plugin code runs with elevated privileges.", "risk_and_exploitability": "The CVSS score of 8.8 signals a high\u2011severity flaw. The EPSS score is less than 1 percent, indicating a very low predicted exploitation probability at the time of analysis, and it is not listed in the CISA KEV catalog. However, because the attack requires a valid account with subscriber or higher access, the threat remains significant for sites with many users or who rely on the plugin. An attacker would use the rtafar_ajax endpoint to trigger the plugin\u2019s internal functions and inject malicious code, potentially compromising the site."}}}}, "created": "2025-11-10T09:33:25.482744+00:00", "updated": "2026-04-22T14:00:18.233866+00:00", "vendors": ["codesolz", "codesolz$PRODUCT$better_find_and_replace", "wordpress", "wordpress$PRODUCT$wordpress"]}