CVE-2025-12360: WordPress Better Find and Replace Auth Bypass

CVE-2025-12360 Overview

CVE-2025-12360 is a missing authorization vulnerability in the Better Find and Replace – AI-Powered Suggestions plugin for WordPress. The flaw affects all versions up to and including 1.7.7. The rtafar_ajax() function lacks a capability check, allowing authenticated users with Subscriber-level access to invoke the plugin's OpenAI-backed AI suggestion feature. Successful abuse consumes the site owner's OpenAI API quota and can incur direct financial cost. The issue is tracked under CWE-285: Improper Authorization.

Critical Impact
Any authenticated Subscriber can trigger OpenAI API calls through the vulnerable AJAX endpoint, exhausting the site owner's paid API quota.

Affected Products

Better Find and Replace – AI-Powered Suggestions plugin for WordPress
All versions up to and including 1.7.7
WordPress sites permitting Subscriber-level registration are at highest risk

Discovery Timeline

2025-11-06 - CVE-2025-12360 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12360

Vulnerability Analysis

The plugin registers a custom AJAX action handled by the rtafar_ajax() function inside core/actions/RTAFAR_CustomAjax.php. The handler is exposed to any authenticated user through the standard WordPress wp-admin/admin-ajax.php interface. Because the function does not call current_user_can() or an equivalent capability gate, WordPress accepts requests from every logged-in role, including Subscriber. Once invoked, the handler forwards a prompt to the OpenAI API using credentials the site administrator configured for the plugin.

The security impact is quota abuse rather than data compromise. Attackers cannot read arbitrary content or modify posts through this endpoint. However, unrestricted invocation lets adversaries drive the site's OpenAI billing upward and disrupt legitimate use of the AI suggestion feature. The vulnerability is exploitable over the network with low attacker privileges and no user interaction.

Root Cause

The root cause is a missing authorization check on a privileged AJAX handler. WordPress AJAX actions registered through wp_ajax_<action> are available to every authenticated user unless the handler enforces a capability requirement. The plugin author did not restrict rtafar_ajax() to administrator or editor roles, so the OpenAI-backed workflow becomes accessible to the lowest privileged account type on the site.

Attack Vector

An attacker registers or already controls a Subscriber account. They then send a crafted POST request to admin-ajax.php referencing the vulnerable action. Each request causes the plugin to issue an outbound call to the OpenAI API using the site's stored key. Scripted repetition of the request produces quota drain and financial impact. Refer to the Wordfence Vulnerability Report and the vulnerable source in the WordPress Plugin Action File for the specific code path.

Detection Methods for CVE-2025-12360

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php from Subscriber accounts referencing the plugin's custom action
Unexpected spikes in OpenAI API usage or billing tied to the site's configured API key
New Subscriber account registrations followed shortly by AJAX activity targeting the plugin

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the rtafar action name from non-administrative users
Correlate WordPress authentication events with outbound API traffic to api.openai.com
Alert on abnormal request rates against admin-ajax.php from a single authenticated session

Monitoring Recommendations

Enable OpenAI usage-based billing alerts to detect abnormal quota consumption early
Forward WordPress and web server logs to a centralized analytics platform for role-aware correlation
Track newly created Subscriber accounts and flag those exhibiting AJAX activity within minutes of registration

How to Mitigate CVE-2025-12360

Immediate Actions Required

Update the Better Find and Replace – AI-Powered Suggestions plugin to a version newer than 1.7.7 that includes the fix
Rotate the OpenAI API key configured in the plugin if abuse is suspected
Temporarily disable public user registration or restrict the default role while patching
Review OpenAI billing dashboards for anomalous usage during the exposure window

Patch Information

The maintainer addressed the issue by adding an authorization check to rtafar_ajax(). Review the fix in the WordPress Plugin Changeset and upgrade all WordPress deployments through the plugin manager or wp-cli.

Workarounds

Deactivate the plugin until an upgrade is applied on production sites
Block or rate-limit admin-ajax.php requests carrying the vulnerable action at the web application firewall
Restrict user registration by setting the default role to a value that cannot reach admin-ajax.php authenticated actions, or disable open registration entirely
Remove the OpenAI API key from the plugin configuration to neutralize cost impact while planning the update

bash

# Update the plugin using wp-cli once a fixed version is published
wp plugin update real-time-auto-find-and-replace

# Or deactivate as a temporary workaround
wp plugin deactivate real-time-auto-find-and-replace

# Disable open registration site-wide
wp option update users_can_register 0