CVE-2025-24734
Published: 27 January 2025
Summary
CVE-2025-24734 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 38.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-24734 is a Missing Authorization vulnerability (CWE-862) in the WordPress plugin Better Find and Replace, also known as real-time-auto-find-and-replace, developed by CodeSolz. This issue enables privilege escalation and affects all versions of the plugin from n/a through 1.6.7 inclusive. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and significant impacts across confidentiality, integrity, and availability.
A low-privileged authenticated user, such as a contributor or subscriber with PR:L access, can exploit this vulnerability remotely over the network without user interaction. Exploitation allows the attacker to escalate privileges, potentially gaining unauthorized control over WordPress site functions, data, and configurations as permitted by the elevated role.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/real-time-auto-find-and-replace/vulnerability/wordpress-better-find-and-replace-plugin-1-6-7-privilege-escalation-vulnerability?_s_id=cve provides further details on the vulnerability, including recommendations for mitigation such as updating the plugin if a patched version is available or removing it if unnecessary.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3926
Vulnerability details
Missing Authorization vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Privilege Escalation.This issue affects Better Find and Replace: from n/a through <= 1.6.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authorization vulnerability (CWE-862) in the WordPress plugin directly enables privilege escalation, allowing a low-privileged authenticated user to gain elevated access and control over site functions.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires enforcement of approved authorizations for access to system resources, addressing the missing authorization check that enabled privilege escalation in the plugin.
Employs least privilege to restrict user and process access to only necessary functions, mitigating unauthorized privilege escalation from low-privileged accounts.
Mandates timely remediation of identified flaws, such as patching or removing the vulnerable Better Find and Replace plugin versions up to 1.6.7.