The Better Find and Replace – AI-Powered Suggestions plugin for WordPress suffers from a code injection vulnerability (CWE-94) in the 'rtafar_ajax' function. This vulnerability arises from inadequate input validation and restrictions, allowing authenticated attackers with low privileges (Subscriber-level and above) to call arbitrary plugin functions and execute code within those functions. The vulnerability affects all versions up to and including 1.7.7. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been provided yet, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to execute arbitrary code within the plugin context. This can lead to full compromise of the WordPress site, including unauthorized data access, modification, or site disruption. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access and above to trusted users only. Monitor for updates from the vendor or plugin maintainers regarding patches or temporary mitigations. Avoid using the affected plugin versions in sensitive environments.