CVE-2022-2593: Better Search and Replace < 1.4.1 - Admin+ SQLi

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-22 · updated 2026-06-17
Weakness: CWE-89

Description

The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks

Affected products

Better Search Replace: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: Better Search Replace 1.4.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/229a065e-1062-44d4-818d-29aa3b6b6d41
https://wpscan.com/vulnerability/229a065e-1062-44d4-818d-29aa3b6b6d41

Get alerted when CVE-2022-2593 or the next vulnerability affects your stack