Better Search Replace
Better Search Replace has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.
The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (50%). Other recurring categories include SQL Injection.
Every one of the 2 issues recorded for Better Search Replace has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Better Search Replace is installed on roughly 1,000,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2023-6933Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection
Read the full analysisVulnerability Records

Better Search Replace
Author
WP Engine
When moving your WordPress site to a new domain or server, you will likely run into a need to run a search/replace on the database for everything to work correctly. Fortunately, there are several plugins available for this task, however, all have a different approach to a few key features. This plugin consolidates the best features from these plugins, incorporating the following features in one simple plugin: Serialization support for all tables The ability to select specific tables The ability to run a “dry run” to see how many fields will be updated No server requirements aside from a running installation of WordPress WordPress Multisite support Time-saving features available in the Pro version: View exactly what changed during a search/replace Backup and import the database while running a search/replace Priority email support from the developer of the plugin Save or load custom profiles for quickly repeating a search/replace in the future Support and updates for 1 year Learn more about Better Search Replace Pro The search and replace functionality is heavily based on interconnect/it’s great and open-source Search Replace DB script, modified to use WordPress native database functions to ensure compatibility. Want to contribute? Feel free to open an issue or submit a pull request on GitHub.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C