Search & Replace

Search & Replace has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 8.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (50%). Other recurring categories include SQL Injection.

Every one of the 2 issues recorded for Search & Replace has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Search & Replace is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.

Strategic Overview

Avg CVSSHigh
8.5/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Search & Replace vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-38759

Search & Replace <= 3.2.2 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

2 records
Search & Replace banner
Latestv3.2.3

Search & Replace

WP Media

Author

WP Media

4.3(283)
86/100
Last Updated
2024-08-26 (2y ago)
Active Installs
100,000+
Downloads
3,206,986
Requires WP
4.0+
Requires PHP
5.6+
Tested up to
WP 6.5.10
Created
2007-05-14 (20y ago)

With Search & Replace you can search for everything and replace this with everything but before you do this you can easily create a simple database backup and restore it. For avoiding problem please keep in mind that this plugin search and replace strictly what is specified in “Replace With”. Common error example: Search For: http://web.com/wordpress/ Replace With: http://neuweb.com/wordpress The url become something like: http://neuweb.com/wordpresscontent/… Correct “Replace with”: Search For: http://web.com/wordpress/ Replace With: http://neuweb.com/wordpress/ The url become something like: http://neuweb.com/wordpress/content/… We have implemented special features! The first one is “Replace a Domain / URL” that is useful for a quick and simple transfer or a migration of a WordPress site. The second feature is full support for serialized data. There are a lot more features – check them out! 🙂 Our goal with this plugin is to give you a good solution for manipulating your data for both Developers and Users of WordPress. Note: This plugin requires PHP 5.6 or higher to be activated. Checkout our GitHub Repository Features Search & replace data in your WordPress database Change domain/URL of WordPress installation Handle serialized data Choose dry run or download SQL file Change table prefix Backup & restore your database WordPress Multisite support Localized and ready for your own language Crafted by WP Media Made by WP Media. Donation? You want to donate – we prefer a positive review, not more.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C