CVE-2025-10313 is a missing authorization vulnerability (CWE-862) in the Find And Replace content for WordPress plugin by jankimoradiya. The issue arises from the lack of a capability check in the far_admin_ajax_fun() function, which is accessible without authentication in all versions up to and including 1.1. This allows unauthenticated attackers to inject arbitrary web scripts into WordPress pages, enabling stored cross-site scripting and arbitrary content replacement. The vulnerability can facilitate privilege escalation and malicious redirects. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and low confidentiality and integrity impact without availability impact. No patch or official fix has been disclosed.

Successful exploitation enables unauthenticated attackers to inject persistent malicious scripts into affected WordPress sites, which can lead to privilege escalation and redirect users to malicious sites. This compromises site integrity and user trust. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative AJAX functions and consider disabling or removing the plugin if possible to prevent exploitation.