बेहतर खोज और बदलें <= 1.7.7 - प्रमाणित (सदस्य+) सीमित कोड इंजेक्शन

The impact of CVE-2025-9334 is significant, as it enables authenticated attackers to execute arbitrary code within the plugin's context. This could allow an attacker to modify site content, steal sensitive data, install malicious plugins, or even gain full control of the WordPress site. The requirement for only Subscriber-level access lowers the barrier to exploitation, increasing the potential attack surface. While the injection is 'limited,' the ability to call arbitrary plugin functions provides a substantial attack vector, particularly if the plugin itself contains vulnerabilities or insecure code.

WordPress sites using the Better Find and Replace – AI-Powered Suggestions plugin, particularly those with a large number of users with Subscriber-level or higher access, are at risk. Shared hosting environments where plugin updates are not managed centrally are also particularly vulnerable, as they may be slow to apply the necessary patch.

• wordpress / plugin: Use wp-cli plugin update to check for available updates. • wordpress / plugin: Search plugin files (e.g., rtafar_ajax.php) for instances of user-supplied data being directly used in function calls without proper sanitization. • generic web: Monitor WordPress access logs for unusual requests to wp-content/plugins/better-find-and-replace-ai-powered-suggestions/ajax-handler.php with potentially malicious parameters. • generic web: Use curl to test the wp-content/plugins/better-find-and-replace-ai-powered-suggestions/ajax-handler.php endpoint with crafted payloads to attempt code execution (only on test environments!).

curl -X POST -d 'param1=system("whoami")' https://your-wordpress-site.com/wp-content/plugins/better-find-and-replace-ai-powered-suggestions/ajax-handler.php

1. 2025-11-08Disclosure

   disclosure

1. आरक्षित2025-08-21
2. प्रकाशित2025-11-08
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-9334 is to immediately upgrade the Better Find and Replace – AI-Powered Suggestions plugin to version 1.7.8 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting access to the 'rtafarajax' endpoint. While not a complete fix, this can reduce the immediate risk. Monitor WordPress access logs for suspicious activity related to the plugin, specifically requests to the 'rtafarajax' endpoint with unusual parameters. After upgrading, confirm the vulnerability is resolved by attempting to trigger the injection with a known payload and verifying that it is blocked.

सक्रिय इंस्टॉलेशन

50Kज्ञात

प्लगइन रेटिंग