Better Find and Replace WordPress Plugin Missing Authorization Vulnerability

A vulnerability exists in the Better Find and Replace – AI-Powered Suggestions plugin for WordPress, in all versions through 1.7.7. The issue arises from a missing capability check in the rtafar_ajax() function, allowing authenticated attackers with Subscriber-level access to misuse the OpenAI API key. This unauthorized usage can lead to excessive quota consumption, potentially incurring costs.

Impact

Exploitation of this vulnerability allows for unauthorized usage of the OpenAI API, leading to increased costs for the affected WordPress site.

Remediation

Users can update to version 1.7.8 or a newer patched version to address this vulnerability.