CVE-2025-12360

Better Find and Replace <= 1.7.7 - Missing Authorization

Published Nov 6, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost.

Analysis

Technical impact

The Better Find and Replace – AI-Powered Suggestions plugin contains a missing capability check in the rtafar_ajax() function across all versions up to 1.7.7. As a result, any authenticated user with Subscriber-level access can trigger the plugin to call the OpenAI API using the site’s API key. This allows the attacker to consume API quota and potentially generate unintended charges to the site owner, without exposing code execution or data exfiltration abilities.

Affected Systems

WordPress sites using the Better Find and Replace – AI-Powered Suggestions plugin, versions up through 1.7.7, are affected.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity, but the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have authenticated access as a Subscriber; once logged in, the attacker can simply invoke the unauthorized API endpoint to trigger costly OpenAI requests.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

codesolz

Better Find and Replace – AI-Powered Suggestions

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.7.7

No data.

Vendor	Product	Versions
Codesolz	Better Find And Replace	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Better Find and Replace – AI-Powered Suggestions plugin to a patched version that resolves the missing capability check.
If upgrading immediately is not possible, block or hard‑code the rtafar_ajax endpoint for Subscriber users (e.g., via a custom plugin or .htaccess) to prevent unauthorized API calls until a patch is applied.
Consider revoking or temporarily disabling the site's OpenAI API key in WordPress settings to stop external calls until the plugin is fixed.

Generated by OpenCVE AI on April 22, 2026 at 12:54 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.234% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php#L31
https://plugins.trac.wordpress.org/changeset/3389979/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php?contextall=1&old=3343531&old_path=%2Freal-time-auto-find-and-replace%2Ftrunk%2Fcore%2Factions%2FRTAFAR_CustomAjax.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/757e41dd-d72f-4e87-a087-c5c38bd727e5?source=cve

History

Nov 6, 2025 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Codesolz Codesolz better Find And Replace Wordpress Wordpress wordpress
Vendors & Products		Codesolz Codesolz better Find And Replace Wordpress Wordpress wordpress

Nov 6, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 6, 2025 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost.
Title		Better Find and Replace <= 1.7.7 - Missing Authorization
Weaknesses		CWE-285
References		https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php#L31 https://plugins.trac.wordpress.org/changeset/3389979/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php?contextall=1&old=3343531&old_path=%2Freal-time-auto-find-and-replace%2Ftrunk%2Fcore%2Factions%2FRTAFAR_CustomAjax.php https://www.wordfence.com/threat-intel/vulnerabilities/id/757e41dd-d72f-4e87-a087-c5c38bd727e5?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`