CVE-2023-6933

What it actually does

The Better Search Replace WordPress plugin through version 1.4.4 deserializes attacker-controlled input, allowing unauthenticated PHP object injection. The vulnerable plugin does not itself include a known property-oriented programming gadget chain, but WordPress sites commonly run many plugins and themes; if any installed component provides a compatible magic-method gadget chain, the injected object can trigger file deletion, sensitive data disclosure, or arbitrary code execution. Because exploitation depends on the presence of a usable POP chain in the broader WordPress installation, impact ranges from failed object injection to full site compromise.

Why it matters to the business

A successful attack can compromise a WordPress site, expose stored content or configuration secrets, delete important files, or allow the attacker to execute code under the web server account. This can lead to website defacement, malware placement, credential theft, SEO spam, customer data exposure, downtime, and recovery costs. The risk is elevated because the vulnerability is weaponized, remotely reachable, does not require attacker authentication, has a high EPSS score, and affects a widely deployed WordPress plugin ecosystem where compatible third-party gadget chains may exist.

How an attack unfolds

An attacker first identifies a WordPress site running Better Search Replace version 1.4.4 or earlier. They then craft a request containing a serialized PHP object payload and deliver it to the vulnerable plugin workflow, potentially relying on user interaction where the vulnerable request path requires a legitimate user to trigger the action. When the plugin passes the untrusted input to PHP deserialization, the attacker-controlled object is instantiated. If another installed plugin, theme, or library exposes a compatible magic method such as __wakeup, __destruct, __toString, or similar, the payload can invoke that gadget chain. Depending on the available chain, the attacker may read sensitive files such as WordPress configuration, delete arbitrary files, write a web shell, or execute commands as the web server user. If no compatible gadget chain exists, the object injection may not progress beyond deserialization, but the site remains exposed as its plugin and theme mix changes over time.

How to fix it

Upgrade Better Search Replace to a vendor-supported version newer than 1.4.4 as soon as possible. If an exact fixed version is not specified in internal package metadata, update to the latest version available from the WordPress plugin repository or the vendor. If immediate upgrade is not possible, disable and remove the plugin until it can be safely updated. Reduce exploitability by removing unused plugins and themes, keeping all WordPress components current, disabling direct PHP file editing in WordPress, restricting administrative access, and ensuring the web server account cannot write to unnecessary directories. Treat mitigation by web application firewall rule alone as temporary because PHP object injection risk depends on the full installed plugin and theme set.

How to confirm the fix worked

Confirm that Better Search Replace is no longer present at version 1.4.4 or earlier. Validate through the WordPress admin plugin inventory, WP-CLI, filesystem inspection under wp-content/plugins/better-search-replace, or software composition/scanner results. Using WP-CLI, run plugin inventory checks such as `wp plugin list` and verify the installed Better Search Replace version is newer than 1.4.4 or that the plugin is inactive/removed. Confirm no outdated copies remain in backups, staging paths, alternate document roots, container images, or deployment artifacts. After remediation, review web server and application logs for historical requests containing serialized PHP object patterns targeting WordPress endpoints.

Typical attack path

1. Scan public WordPress sites for indicators of the Better Search Replace plugin or version exposure.
2. Confirm the target is running a vulnerable version, 1.4.4 or earlier.
3. Fingerprint installed plugins, themes, or libraries to identify a compatible PHP object gadget chain.
4. Craft a serialized PHP object payload that maps to the available gadget chain.
5. Send or induce submission of the malicious request to the vulnerable plugin functionality.
6. Trigger PHP deserialization and object instantiation on the server.
7. Use the resulting gadget chain to read sensitive data, delete files, write malicious files, or execute code.
8. Establish persistence, modify site content, steal credentials, or pivot further if code execution is achieved.

How to detect it

Investigate web server access logs, reverse proxy logs, WAF events, PHP error logs, WordPress debug logs, and endpoint/file integrity telemetry. Look for requests to WordPress administrative or AJAX endpoints containing PHP serialized object syntax, especially URL-encoded `O:` object markers, class-name-like payloads, or magic-method references. Pay particular attention to traffic involving `/wp-admin/admin-ajax.php`, plugin-related paths, or requests shortly followed by file changes under the WordPress document root. Because successful impact often depends on a gadget chain from another plugin or theme, also hunt for post-exploitation artifacts: newly created or modified PHP files, suspicious files in upload directories, changes to `wp-config.php`, unexpected WordPress administrator accounts, outbound connections from the web server process, and PHP errors referencing `unserialize()`, incomplete classes, or magic methods. Correlate suspicious requests with file modification timestamps and web server process activity.

• /wp-content/plugins/better-search-replace/
• better-search-replace
• /wp-admin/admin-ajax.php
• O%3A
• O:
• __wakeup
• __destruct
• __toString
• unserialize()
• __PHP_Incomplete_Class
• /wp-content/uploads/
• wp-config.php

What your security team should do

• Prioritize remediation because exploitation is weaponized, the EPSS score is high, and no authentication is required by the attacker.
• Inventory all WordPress installations and identify any running Better Search Replace version 1.4.4 or earlier.
• Upgrade the plugin to the latest vendor-supported release or disable/remove it where it is not required.
• Patch all other WordPress plugins, themes, and bundled libraries to reduce the chance of a usable POP gadget chain.
• Search historical web logs for serialized PHP object payloads, especially URL-encoded `O:` patterns, sent to WordPress administrative or AJAX endpoints.
• Inspect compromised-suspect sites for recently modified PHP files, unauthorized administrator accounts, unexpected scheduled tasks, web shells, and changes to wp-config.php.
• Add temporary WAF detections for PHP serialized object payloads in requests to WordPress endpoints while patching is underway.
• Review file permissions so the web server process cannot write outside required upload/cache/plugin update locations.