CVE-2024-4145: 
WordPress vulnerability analysis and mitigation

The Search & Replace WordPress plugin before version 3.2.2 contains a SQL injection vulnerability identified as CVE-2024-4145. The vulnerability was discovered and reported by Krugov Artyom, and was publicly disclosed on May 23, 2024. This security issue affects WordPress installations using the Search & Replace plugin, particularly in multi-site network configurations (WPScan).

The vulnerability stems from improper parameter sanitization and escaping in SQL statements. It has been classified as CWE-89 (SQL Injection) with a CVSS v3.1 base score of 7.2 (HIGH) according to NVD, while CISA-ADP rates it at 3.8 (LOW). The vulnerability requires high privileges (admin access) to exploit, but has potential for high impact on confidentiality, integrity, and availability (NVD).

If exploited, this vulnerability allows authenticated administrators to perform SQL injection attacks, particularly within multi-site network environments. The impact is significant as it could potentially lead to unauthorized database access, manipulation, or extraction of sensitive information (WPScan).

The vulnerability can be exploited through the Tools parameter in the WordPress admin interface. An attacker can manipulate the search and replace functionality by intercepting requests and injecting malicious SQL queries. A proof of concept exists demonstrating the exploitation using specific parameters in the request (WPScan).

The vulnerability has been patched in version 3.2.2 of the Search & Replace plugin. Users are strongly advised to update to this version or later to mitigate the risk (WPScan).