CVE-2025-12360: Codesolz Better Find And Replace – Ai-Powered Suggestions

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost.

Affected products

• Codesolz Better Find And Replace – Ai-Powered Suggestions: up to and including 1.7.7

Published 2025-11-06. Last modified 2026-10-07.