CVE-2024-38759

The Search & Replace plugin through version 3.2.2 contains a PHP Object Injection vulnerability caused by unsafe deserialization of untrusted input, allowing unauthenticated attackers to inject malicious PHP objects. While the plugin itself lacks a known gadget chain for exploitation, the presence of a POP chain in other installed plugins or themes could enable attackers to delete files, access sensitive information, or achieve arbitrary code execution. The vulnerability was patched in version 3.2.3.

Based on public CVE data (MITRE/NVD).