CVE-2023-6933

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/browser/better-search-replace/trunk/includes/class-bsr-db.php#L334Exploit
• https://plugins.trac.wordpress.org/changeset/3023674/better-search-replace/trunk/includes/class-bsr-db.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/895f2db1-a2ed-4a17-a4f6-cd13ee8f84af?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/better-search-replace/trunk/includes/class-bsr-db.php#L334Exploit
• https://plugins.trac.wordpress.org/changeset/3023674/better-search-replace/trunk/includes/class-bsr-db.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/895f2db1-a2ed-4a17-a4f6-cd13ee8f84af?source=cveThird Party Advisory

Published

Feb 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6927A flaw was found in Keycloak. This issue may allow an attack…6.1
• CVE-2023-6928 EuroTel ETL3100 versions v01c01 and v01x37 does not limit t…9.8
• CVE-2023-6929 EuroTel ETL3100 versions v01c01 and v01x37 are vulnerab…9.8
• CVE-2023-6930 EuroTel ETL3100 versions v01c01 and v01x37 suffer f…9.8
• CVE-2023-6931A heap out-of-bounds write vulnerability in the Linux kernel…7
• CVE-2023-6932A use-after-free vulnerability in the Linux kernel's ipv4: i…7
• CVE-2023-6934The Limit Login Attempts Reloaded plugin for WordPress is vu…5.4
• CVE-2023-6935wolfSSL SP Math All RSA implementation is vulnerable to the …5.9
• CVE-2023-6936In wolfSSL prior to 5.6.6, if callback functions are enabled…9.1
• CVE-2023-6937wolfSSL prior to 5.6.6 did not check that messages in one (D…5.3
• CVE-2023-6938The Oxygen Builder plugin for WordPress is vulnerable to Sto…5.4
• CVE-2023-6939 Some Honor products are affected by type confusion vulnerab…5.5