CVE-2025-9334: 
WordPress vulnerability analysis and mitigation

CVE-2025-9334 is a Limited Code Injection vulnerability in the Better Find and Replace – AI-Powered Suggestions WordPress plugin (by CodeSolz), affecting all versions up to and including 1.7.7. The flaw allows authenticated attackers with Subscriber-level access or higher to call arbitrary plugin functions and execute code within those functions. It was published on November 8, 2025, and assigned a CVSS v3.1 base score of 8.8 (High) by Wordfence (Wordfence, NVD).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) and stems from insufficient input validation and access restriction in the rtafar_ajax function within RTAFAR_CustomAjax.php (line 29). This function fails to properly restrict which plugin functions can be invoked, allowing a low-privilege authenticated user to pass arbitrary function names and parameters through AJAX requests. Supporting vulnerable code paths are also present in DbReplacer.php (line 507) and Util.php (line 233), which handle database replacement and utility operations respectively (NVD, WordPress Trac).

Successful exploitation grants an attacker with only Subscriber-level WordPress credentials the ability to execute arbitrary code within the plugin's function scope, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive site data, modify site content or configurations, and potentially disrupt site availability. Depending on the functions exposed, exploitation could also facilitate privilege escalation or further lateral movement within the WordPress installation (Wordfence, NVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.067%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Better Find and Replace – AI-Powered Suggestions plugin (version ≤ 1.7.7) using tools like WPScan or by checking /wp-content/plugins/real-time-auto-find-and-replace/ for plugin presence.
2. Obtain low-privilege credentials: Register or obtain a Subscriber-level (or higher) WordPress account on the target site — the minimum privilege required for exploitation.
3. Authenticate: Log in to the WordPress site and obtain a valid authentication nonce or session cookie.
4. Craft malicious AJAX request: Send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the rtafar_ajax action, supplying an arbitrary plugin function name and desired parameters in the request body.
5. Trigger code execution: The rtafar_ajax function, lacking proper input validation, invokes the specified plugin function with attacker-controlled arguments, executing arbitrary code within the plugin's context.
6. Achieve objective: Depending on the functions available, the attacker may exfiltrate data, modify database content, or escalate privileges within the WordPress installation (NVD, WordPress Trac).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=rtafar_ajax and unexpected or encoded function name parameters from low-privilege user sessions.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php with rtafar_ajax action from Subscriber-level accounts; unexpected database modification entries in WordPress debug logs.
• File System: Unexpected changes to WordPress database content (posts, options, or user data) consistent with automated find-and-replace operations not initiated by administrators.
• Process: Unusual PHP function calls or errors in server error logs originating from RTAFAR_CustomAjax.php, DbReplacer.php, or Util.php plugin files.

The vendor (CodeSolz) released a patched version of the plugin; users should update the Better Find and Replace – AI-Powered Suggestions plugin to a version beyond 1.7.7 immediately via the WordPress plugin repository (changeset 3389979 addresses the issue) (WordPress Trac). As an interim measure, site administrators should restrict or remove unnecessary Subscriber-level user accounts and consider deactivating the plugin until the update is applied. Additionally, a thorough security audit of the WordPress installation and monitoring for unauthorized access or unexpected database changes is recommended (Wordfence).

Wordfence, the CNA that assigned and disclosed this CVE, published it as part of their weekly WordPress vulnerability report covering November 3–9, 2025 (Wordfence Blog). Sucuri included the vulnerability in their November 2025 vulnerability patch roundup, highlighting it as a notable WordPress plugin issue requiring prompt patching (Sucuri Blog). Qualys added detection coverage for the vulnerability in their November 2025 application security detections release (Qualys). Community reaction on social platforms (Mastodon, Bluesky) was limited to routine CVE notification posts with no significant researcher commentary.