CVE Alert: CVE-2025-9334 – codesolz – Better Find and Replace – AI-Powered Suggestions

**Risk verdict**: High risk: authenticated limited code injection could enable remote code execution via the plugin; no KEV or EPSS exploitation signals are provided in the data.

**Why this matters**: An attacker with Subscriber+ access could run arbitrary PHP within the site context, potentially compromising the entire WordPress installation, exfiltrating data or implanting backdoors. This is particularly dangerous for e-commerce, CRM, or sites handling sensitive personal or financial data, where persistence and access to credentials are attractive for attackers.

**Most likely attack path**: The flaw requires network access but no user interaction and relies on low privileges (Subscriber+). An authenticated user can trigger the vulnerable rtafar_ajax endpoint to call arbitrary plugin functions, bypassing input validation to achieve code injection. The attack would operate within the plugin’s context (Scope: unchanged) with high impact on confidentiality, integrity and availability.

**Who is most exposed**: WordPress sites using Better Find and Replace – AI-Powered Suggestions, especially multisite or organisations with many registered users; hosted environments where Subscriber+ accounts exist are at higher risk.

**Detection ideas**:

• Unusual or elevated admin-ajax.php requests targeting rtafar_ajax with odd parameters.
• PHP errors or logs showing execution of unexpected plugin functions.
• New or anomalous subscriber accounts or activity tied to the plugin.
• Defacement indicators or unexpected content changes within the plugin’s files.
• Spikes in 500 errors after authenticated requests to the plugin.

**Mitigation and prioritisation**:

• Patch to the latest version (post-1.7.7) or disable the plugin if a fix is unavailable.
• Enforce least privilege; remove or restrict Subscriber+ rights for this plugin where possible.
• Deploy WAF rules to validate rtafar_ajax inputs and block suspicious calls.
• Enable file integrity monitoring and application-layer auditing around the plugin.
• Test in staging, validate backups, and schedule a controlled patch window.