The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to limited code injection through the rtafar_ajax function. The flaw stems from insufficient input validation and a lack of restrictions, allowing an authenticated user with at least subscriber privileges to invoke arbitrary plugin functions and execute code within those functions. This weakness is a classic code injection scenario (CWE‑94) and can lead to remote code execution on the server if the plugin code runs with elevated privileges.

The issue impacts all versions of the Better Find and Replace – AI‑Powered Suggestions plugin released by codesolz up to and including 1.7.7. Any installation using a version equal to or lower than 1.7.7 is affected; versions beyond 1.7.7 are not impacted.

The CVSS score of 8.8 signals a high‑severity flaw. The EPSS score is less than 1 percent, indicating a very low predicted exploitation probability at the time of analysis, and it is not listed in the CISA KEV catalog. However, because the attack requires a valid account with subscriber or higher access, the threat remains significant for sites with many users or who rely on the plugin. An attacker would use the rtafar_ajax endpoint to trigger the plugin’s internal functions and inject malicious code, potentially compromising the site.