{
 "id": "WPSEC-2026-3085",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3085/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3085/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3085/index.md",
 "title": "Search & Replace <= 3.2.3 - Authenticated (Administrator+) Missing Authorization to Network-Wide SQL Import on Multisite",
 "description": "The Search & Replace plugin for WordPress is vulnerable to unauthorized access via the SQL Import page in all versions up to, and including, 3.2.3. This is due to the plugin requiring only the manage_options capability, which every sub-site administrator on a multisite network has, for its pages, and to the page save handler checking only a nonce before running the submitted page's action. This makes it possible for authenticated attackers with sub-site administrator access on a multisite installation, who lack network-level capabilities, to import arbitrary SQL against the shared network database, for example to modify any site's data or grant themselves super administrator privileges.",
 "plugin": {
  "slug": "search-and-replace",
  "name": "Search & Replace",
  "full_name": "Search & Replace",
  "wordpress_org": "https://wordpress.org/plugins/search-and-replace/",
  "advisories_url": "https://wpsec.com/vuln/plugin/search-and-replace/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/search-and-replace"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 9.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "severity": "Critical"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.2.0",
    "from_inclusive": true,
    "to": "3.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.2.0 before 3.2.4"
  ]
 },
 "introduced_in": "3.2.0",
 "fixed_in": "3.2.4",
 "remediation": "Update to 3.2.4 or later.",
 "fix_released": "2026-11-12T14:59:58+00:00",
 "published": "2026-11-13T16:44:01+00:00",
 "updated": "2026-11-13T15:57:02.739701+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3085/",
  "https://plugins.svn.wordpress.org/search-and-replace/tags/3.2.4/",
  "https://wordpress.org/plugins/search-and-replace/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/search-and-replace",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}