Better Search Replace Vulnerability – Unauthenticated PHP Object Injection – CVE-2023-6933 | WordPress Plugin Vulnerability Report

Q: Is my site vulnerable to this PHP object injection attack?

Is my site vulnerable to this PHP object injection attack? If you are using a version of the Better Search Replace plugin equal to or less than 1.4.4, then yes your site is vulnerable. This vulnerability allows attackers to remotely inject harmful PHP objects without authentication due to improper input sanitization. All versions up to and including 1.4.4 contain the flaw.

Q: What kind of damage can hackers actually do by exploiting this vulnerability?

What kind of damage can hackers actually do by exploiting this vulnerability? While the vulnerability itself does not contain a full proof of concept attack that could allow actions like remote code execution or data theft, it makes injection possible. If other installed plugins or your theme have chains of vulnerable PHP object calls, the injected objects could then enable much more critical impacts. So even without those secondary vulnerabilities, the flaw opens doors for attackers. And many WordPress sites use various plugins/themes that may contain additional weaknesses.

Q: Should I just delete Better Search Replace entirely instead of updating?

Should I just delete Better Search Replace entirely instead of updating? Deleting problematic plugins is generally a good security step for outdated or vulnerable extensions that you are not actively using. However, in this case the plugin developers have quickly patched the vulnerability in version 1.4.5. So sites actively using Better Search Replace for search/replace functionality are recommended to update to this latest fixed release, rather than fully removing the plugin. Deleting may be an option if you have alternate search tools.

Q: How urgent is it that I update to the latest version?

How urgent is it that I update to the latest version? Updating Better Search Replace should be treated as an extremely urgent priority. The vulnerability is considered critical severity with a CVSS score of 9.8 out of 10. Attackers may already be actively scanning for sites to target. Plus, this vulnerability has now become public knowledge with the disclosure. Leaving the issue unpatched essentially paints a target on sites.

Q: Why wasn’t this vulnerability discovered during initial Better Search Replace testing?

Why wasn’t this vulnerability discovered during initial Better Search Replace testing? Typically vulnerabilities like this result from unexpected use cases or interactions that were not considered during initial functionality testing. The underlying issue of deserializing untrusted data without sanitization is also a common oversight. Proper security auditing often happens later in the development process or via third-party penetration testing teams. The plugin scene moves so rapidly that deep security analysis falls behind. Publishers like Wordfence performing ongoing audits help catch these issues.

Q: What security precautions should I take in addition to updating Better Search Replace?

What security precautions should I take in addition to updating Better Search Replace? While patching this current critical issue is urgent, additional security steps help lock down WordPress tight against future vulnerabilities including: Enable auto background updates, reduce unused plugins, add security plugins like Wordfence, utilize firewalls, schedule regular backups, and potentially leverage managed WordPress hosting for fully managed security services if you lack resources.

Q: How can I check if someone has already attacked my site using this vulnerability?

How can I check if someone has already attacked my site using this vulnerability? Review your site logs for requests targeting the Better Search Replace plugin, especially suspicious POST requests. Check with your host to see if they have identified or blocked any related attacks already. Install server intrusion detection software if possible. You likely will not see direct evidence of any objects injected, but can spot reconnaissance efforts and block attempts via other protections before exploitation happens.

Q: Are other plugins likely vulnerable to issues like this as well?

Are other plugins likely vulnerable to issues like this as well? Unfortunately yes. Insecure deserialization and insufficient input validation are extremely common issues in WordPress plugins and themes. The plugin ecosystem often emphasizes fast development over security best practices. Vulnerabilities in popular plugins are disclosed constantly. This reinforces why keeping everything updated at all times is so critical for sites.

Q: Can my web host help at all with issues like this?

Can my web host help at all with issues like this? Managed WordPress hosts often have security teams that actively identify and block attacks against their infrastructure and customers. So your host may have already protected your site. At minimum, they can help identify any evidence of targeting. The best managed hosts also have auto-updating, malware scanning, website firewalls, and other layers that secure sites against vulnerabilities in other extensions. This protection remains extremely valuable.

By Your WP Guy | January 24, 2024

Plugin Name: Better Search Replace

Key Information:

Software Type: Plugin
Software Slug: better-search-replace
Software Status: Active
Software Author: wpengine
Software Downloads: 12,169,696
Active Installs: 1,000,000
Last Updated: January 24, 2024
Patched Versions: 1.4.5
Affected Versions: <= 1.4.4

Vulnerability Details:

Name: Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection
Type: Deserialization of Untrusted Data
CVE: CVE-2023-6933
CVSS Score: 9.8 (Critical)
Publicly Published: January 24, 2024
Researcher: Sam Pizzey
Description: The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Summary:

The Better Search Replace for WordPress has a critical vulnerability in versions up to and including 1.4.4 that allows unauthenticated PHP object injection. This vulnerability has been patched in version 1.4.5.

Detailed Overview:

The Better Search Replace plugin up to version 1.4.4 contains a vulnerability that allows unauthenticated attackers to inject malicious PHP objects due to the plugin deserializing user input without proper sanitization. Researcher Sam Pizzey disclosed that while no proof of concept chain currently exists within the vulnerable plugin itself that would enable remote code execution or other impacts, the presence of a POP chain in other installed plugins or themes could be leveraged to escalate the attack. With over 12 million downloads and an estimated 1 million active installations, this is a widely used plugin and prompt updating is advised. Version 1.4.5 patches the vulnerability by properly sanitizing input prior to deserializing.

Advice for Users:

Immediate Action: Update to version 1.4.5 or higher as soon as possible.
Check for Signs of Vulnerability: Review server logs for any suspicious requests targeting the Better Search Replace plugin. Also check with your host or security team to see if any potential attacks have been blocked.
Alternate Plugins: Consider alternate search/replace plugins like Search & Replace or Search Regex as a precaution, even after updating.
Stay Updated: Enable automatic background updates in WordPress to ensure plugins stay updated to the latest secure versions.

Conclusion:

The quick response by the developers to patch this critical remote code execution vulnerability is reassuring. All users of Better Search Replace are strongly urged to update immediately to protect their WordPress sites.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/better-search-replace

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/better-search-replace/better-search-replace-144-unauthenticated-php-object-injection

Detailed Report:

Keeping your WordPress website and its plugins up-to-date is critical for security, as outdated software can contain dangerous vulnerabilities. This point has been underscored this week by the disclosure of a critical security flaw impacting popular WordPress plugin Better Search Replace. Versions up to and including 1.4.4 contain an “unauthenticated PHP object injection” vulnerability, allowing potential malicious attackers to inject harmful PHP code into vulnerable sites. In this post, I’ll discuss the details of this vulnerability, how site owners can update to stay secure, and additional best practices around WordPress security and maintenance.

About Better Search Replace

Better Search Replace is an extremely popular WordPress plugin with over 12 million downloads and an estimated 1 million active installs. The plugin provides enhanced search and replace functionality within the WordPress database. It was developed by WPEngine and is currently still an active project.

The Vulnerability Researcher

Sam Pizzey disclosed that Better Search Replace versions up to and including 1.4.4 contain a vulnerability allowing unauthenticated remote attackers to inject PHP objects due to the plugin improperly deserializing user input. While the plugin itself does not contain a full proof of concept attack, if other installed plugins or the theme have vulnerable PHP object chains, this could enable remote code execution, data access or deletion, or other critical impacts.

The vulnerability has been assigned a CVSS score of 9.8, meaning it is critical severity. All unsupported versions of Better Search Replace should be considered highly dangerous.

Updating to Stay Secure

Developers have acted quickly to patch the vulnerability in version 1.4.5. All users of Better Search Replace should immediately update to this latest version or higher.

You can update the plugin from the WordPress dashboard by:

Going to “Plugins” and clicking “Update Now”
Manually deleting the existing plugin and reinstalling fresh.

Be sure to verify the install by going to the plugin details and ensuring it is Version 1.4.5.

Additional Security Best Practices

While the prompt update addresses this current threat, site owners need to be proactive to protect against future vulnerabilities:

Enable automatic background updates in WordPress to maintain plugins/themes
Regularly audit plugins and remove unused old plugins
Consider security-focused plugins like Wordfence for alerting and firewall
Utilize security measures offered by your host
Schedule regular backups in case disaster strikes
Consider migrating to a managed WordPress host for fully managed security

For small business owners without much time to actively manage sites, seeking help from a managed hosting provider or WordPress support firm may be wise to offload the work of staying secure. They can help ensure everything stays updated, backups run smoothly, and issues get addressed without you needing to jump into action.

Staying Locked Down

This Better Search Replace situation exemplifies why constant vigilance around security is so vital for WordPress sites. New threats come out constantly, and outdated software is an easy open door for attacks. While extremely inconvenient to have yet another vulnerability to deal with, the WordPress community has acted admirably in identifying the issue and releasing a quick patch. Be sure to update and utilize other best practices to lock down tight. Reach out for any help keeping secured!

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Better Search Replace Vulnerability - Unauthenticated PHP Object Injection - CVE-2023-6933 | WordPress Plugin Vulnerability Report FAQs

Is my site vulnerable to this PHP object injection attack?

What kind of damage can hackers actually do by exploiting this vulnerability?

While the vulnerability itself does not contain a full proof of concept attack that could allow actions like remote code execution or data theft, it makes injection possible. If other installed plugins or your theme have chains of vulnerable PHP object calls, the injected objects could then enable much more critical impacts.

So even without those secondary vulnerabilities, the flaw opens doors for attackers. And many WordPress sites use various plugins/themes that may contain additional weaknesses.

Should I just delete Better Search Replace entirely instead of updating?

Deleting problematic plugins is generally a good security step for outdated or vulnerable extensions that you are not actively using. However, in this case the plugin developers have quickly patched the vulnerability in version 1.4.5.

So sites actively using Better Search Replace for search/replace functionality are recommended to update to this latest fixed release, rather than fully removing the plugin. Deleting may be an option if you have alternate search tools.

How urgent is it that I update to the latest version?

Updating Better Search Replace should be treated as an extremely urgent priority. The vulnerability is considered critical severity with a CVSS score of 9.8 out of 10. Attackers may already be actively scanning for sites to target.

Plus, this vulnerability has now become public knowledge with the disclosure. Leaving the issue unpatched essentially paints a target on sites.

Why wasn’t this vulnerability discovered during initial Better Search Replace testing?

Typically vulnerabilities like this result from unexpected use cases or interactions that were not considered during initial functionality testing. The underlying issue of deserializing untrusted data without sanitization is also a common oversight.

Proper security auditing often happens later in the development process or via third-party penetration testing teams. The plugin scene moves so rapidly that deep security analysis falls behind. Publishers like Wordfence performing ongoing audits help catch these issues.

What security precautions should I take in addition to updating Better Search Replace?

While patching this current critical issue is urgent, additional security steps help lock down WordPress tight against future vulnerabilities including:

Enable auto background updates, reduce unused plugins, add security plugins like Wordfence, utilize firewalls, schedule regular backups, and potentially leverage managed WordPress hosting for fully managed security services if you lack resources.

How can I check if someone has already attacked my site using this vulnerability?

Review your site logs for requests targeting the Better Search Replace plugin, especially suspicious POST requests. Check with your host to see if they have identified or blocked any related attacks already. Install server intrusion detection software if possible.

You likely will not see direct evidence of any objects injected, but can spot reconnaissance efforts and block attempts via other protections before exploitation happens.

Are other plugins likely vulnerable to issues like this as well?

Unfortunately yes. Insecure deserialization and insufficient input validation are extremely common issues in WordPress plugins and themes. The plugin ecosystem often emphasizes fast development over security best practices.

Vulnerabilities in popular plugins are disclosed constantly. This reinforces why keeping everything updated at all times is so critical for sites.

Can my web host help at all with issues like this?

Managed WordPress hosts often have security teams that actively identify and block attacks against their infrastructure and customers. So your host may have already protected your site. At minimum, they can help identify any evidence of targeting.

The best managed hosts also have auto-updating, malware scanning, website firewalls, and other layers that secure sites against vulnerabilities in other extensions. This protection remains extremely valuable.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged Better Search Replace, CVE-2023-6933, hack prevention, patch vulnerabilities, PHP object injection, Plugin Updates, remote code execution, Website Maintenance, wordpress security, WordPress Vulnerabilities