Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection
CVE-2023-6933 has a selected CVSS score of 8.8 (high); EIP currently links 2 repository PoCs, 1 Nuclei template, and 1 lab environment.
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 22, 2024 · Source: CVE List
| Product | Source | Version range | Status |
|---|---|---|---|
Better Search ReplaceBrowse wpengine / Better Search ReplaceDefault status: unaffected | CVE List, VulnCheck | Through 1.4.4 | affected |
The artifact is a Nuclei template and supporting documentation that detects the presence of the vulnerable Better Search Replace plugin (CVE-2023-6933) and verifies the PHP object injection vulnerability by sending a safe serialized payload and analyzing the HTTP response. It does not execute arbitrary code or exploit the vulnerability for impact.
No backdoor observed in reviewed code
The supplied evidence consists of documentation and a Nuclei template for CVE-2023-6933. The template sends a harmless stdClass serialized object with payload withheld to a known vulnerable endpoint. No concealed executable behavior, persistence, credential theft, or unrelated payload is present. The artifact demonstrates the claimed PHP Object Injection vulnerability without backdoor or deceptive harm.
The primary artifact is a Nuclei template (cve-2023-6933.yaml) that sends HTTP requests to detect the plugin and verify the deserialization vulnerability by analyzing responses. It uses a safe stdClass payload and payload withheld to avoid exploitation. The documentation explicitly states it is a 'non-intrusive' 'Proof-of-Concept' for 'verification' and 'detection', not for achieving code execution or data impact. This matches the definition of a scanner.
CVE-2023-6933_POC_DOCUMENTATION.md:80-82CVE-2023-6933_POC_DOCUMENTATION.md:97-102nuclei-templates/cve-2023-6933.yaml:1-115nuclei-templates/cve-2023-6933.yaml:53nuclei-templates/cve-2023-6933.yaml:72nuclei-templates/cve-2023-6933.yaml:38-40nuclei-templates/cve-2023-6933.yaml:70-80nuclei-templates/cve-2023-6933.yaml:84-101nuclei-templates/cve-2023-6933.yaml:35nuclei-templates/cve-2023-6933.yaml:80nuclei-templates/cve-2023-6933.yaml:80This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Docker Compose environment deploying a WordPress 6.4.0 instance with the vulnerable Better Search Replace plugin (≤1.4.4), a MySQL 8.0 database, and phpMyAdmin for database management. The environment is designed to demonstrate CVE-2023-6933, a PHP Object Injection vulnerability.
docker-compose.yml:1-52readme.md:1-6The README explicitly states the environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin. The Docker Compose file deploys a custom WordPress image ('trex999/vulnerable-bsr-lab:latest') that includes the vulnerable plugin, along with supporting services, forming a complete reproduction environment for the vulnerability.
readme.md:1-6docker-compose.yml:1-52A WordPress 6.4.0 container based on the custom image 'trex999/vulnerable-bsr-lab:latest'. It includes the vulnerable Better Search Replace plugin (version ≤1.4.4) and exposes port 8080 on the host. It connects to the MySQL service for database storage.
docker-compose.yml:2-15readme.md:1-6A MySQL 8.0 database server that stores WordPress data. It uses a named volume 'mysql_data' for persistence and is connected to the 'lab_network' bridge network.
docker-compose.yml:17-28A phpMyAdmin 5.2 instance for managing the MySQL database. It exposes port 8081 on the host and depends on the MySQL service.
docker-compose.yml:30-41A bash script that performs a series of checks and tests against the lab environment to verify the presence and exploitability of CVE-2023-6933. It sends crafted HTTP requests to the WordPress admin-ajax.php endpoint with serialized PHP objects and checks for vulnerability indicators.
manual-test.sh:1-245A document providing detailed technical analysis of the CVE-2023-6933 vulnerability, including root cause, vulnerable code path, and a description of the proof-of-concept methodology using Nuclei templates.
CVE-2023-6933_POC_DOCUMENTATION.md:1-199Supported by supplied evidence
The lab environment is explicitly built to demonstrate CVE-2023-6933. The README, documentation, and testing script all reference this CVE, describe the vulnerable plugin (Better Search Replace ≤1.4.4), and provide methods to trigger the PHP Object Injection via the admin-ajax.php endpoint. The Docker Compose file uses a custom image that includes the vulnerable plugin.
readme.md:1-6CVE-2023-6933_POC_DOCUMENTATION.md:1-10manual-test.sh:1-4readme.md:13-17readme.md:13-22CVE-2023-6933_POC_DOCUMENTATION.md:120-122readme.md:13-17readme.md:24-26readme.md:29-31readme.md:33-36CVE-2023-6933_POC_DOCUMENTATION.md:100-110The lab is a self-contained Docker Compose environment designed for vulnerability research. All exploit attempts target the lab's own WordPress container via localhost. The testing scripts and documentation emphasize non-destructive, read-only testing (e.g., using 'dry_run=1' and safe stdClass objects). No behavior is observed that escapes the container boundary, targets the host, or reaches external systems. Port mappings (8080, 8081) and a named volume are standard for a local lab and do not indicate malicious intent.
docker-compose.yml:1-52CVE-2023-6933_POC_DOCUMENTATION.md:60-80manual-test.sh:1-245This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Attackers can execute arbitrary code, delete files, or retrieve sensitive data on the server.
Update to the latest version of the plugin, version 1.4.5 or later.
Source: ProjectDiscovery