# Search & Replace <= 3.2.3 - Authenticated (Administrator+) Missing Authorization to Network-Wide SQL Import on Multisite

- **ID:** WPSEC-2026-3085
- **Plugin:** Search & Replace (`search-and-replace`), https://wordpress.org/plugins/search-and-replace/
- **Affected versions:** from 3.2.0 before 3.2.4
- **Fixed in:** 3.2.4 (Update to 3.2.4 or later.)
- **Severity:** Critical 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/search-and-replace
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3085/

## Description

The Search & Replace plugin for WordPress is vulnerable to unauthorized access via the SQL Import page in all versions up to, and including, 3.2.3. This is due to the plugin requiring only the manage_options capability, which every sub-site administrator on a multisite network has, for its pages, and to the page save handler checking only a nonce before running the submitted page's action. This makes it possible for authenticated attackers with sub-site administrator access on a multisite installation, who lack network-level capabilities, to import arbitrary SQL against the shared network database, for example to modify any site's data or grant themselves super administrator privileges.

## References

- https://wpsec.com/vuln/WPSEC-2026-3085/
- https://plugins.svn.wordpress.org/search-and-replace/tags/3.2.4/
- https://wordpress.org/plugins/search-and-replace/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3085/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.