Better Search Replace

Better Search Replace has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (50%). Other recurring categories include SQL Injection.

Every one of the 2 issues recorded for Better Search Replace has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Better Search Replace is installed on roughly 1,000,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSHigh
8.0/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Better Search Replace vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2023-6933

Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

2 records
Better Search Replace banner
Latestv1.4.11

Better Search Replace

WP Engine

Author

WP Engine

4.3(544)
86/100
Last Updated
2026-08-25 (18d ago)
Active Installs
1,000,000+
Downloads
18,675,743
Requires WP
6.2+
Requires PHP
8.1+
Tested up to
WP 7.1
Created
2015-01-06 (12y ago)

When moving your WordPress site to a new domain or server, you will likely run into a need to run a search/replace on the database for everything to work correctly. Fortunately, there are several plugins available for this task, however, all have a different approach to a few key features. This plugin consolidates the best features from these plugins, incorporating the following features in one simple plugin: Serialization support for all tables The ability to select specific tables The ability to run a “dry run” to see how many fields will be updated No server requirements aside from a running installation of WordPress WordPress Multisite support Time-saving features available in the Pro version: View exactly what changed during a search/replace Backup and import the database while running a search/replace Priority email support from the developer of the plugin Save or load custom profiles for quickly repeating a search/replace in the future Support and updates for 1 year Learn more about Better Search Replace Pro The search and replace functionality is heavily based on interconnect/it’s great and open-source Search Replace DB script, modified to use WordPress native database functions to ensure compatibility. Want to contribute? Feel free to open an issue or submit a pull request on GitHub.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C