CVE-2024-4145 is a high severity SQL injection in the Search and Replace WordPress plugin before version 3.2.2. NVD scores it 7.2. The attacker needs administrator access, which matters most on multisite networks where site admins should not reach other sites. Update the plugin to version 3.2.2 or later and review who holds admin rights.
What's affected
The record lists the Search & Replace plugin by WP Media for all versions before 3.2.2, so 3.2.2 is the fixed version. The plugin does not sanitize and escape one parameter before using it in a SQL statement. The record says administrators can exploit this, and gives multisite networks as an example.
NVD gives the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The privileges required are high, which holds the score down. On a multisite network, a site administrator is a smaller trust boundary than a network administrator, and this flaw can blur that line.
The only reference is a WPScan entry, which we did not fetch for this draft.
Weakness class: CWE-89 (SQL injection).
How to check if you're exposed
From the WordPress admin, open Plugins, Installed Plugins, and read the version under the plugin name. With WP-CLI on the server you can read it directly:
wp plugin list --fields=name,version,update
Compare the version to the affected range above. If the update column shows available, apply it after a backup.
On a multisite network, check the plugin on every site and at the network level.
What to do now
- Update Search and Replace to 3.2.2 or later on every site where it is installed.
- If the plugin is not in use, remove it. Tools of this kind are often installed for one migration and forgotten.
- Review the list of administrator accounts and remove those no longer needed.
- On multisite networks, check who has super admin rights and who has site admin rights.
- Back up the database before a bulk search and replace run, regardless of this flaw.
Why it matters
SQL injection means input is not kept apart from the query. Because this plugin edits database content in bulk, it already runs with wide database access, and a bug in how it builds queries can expose more than one site's tables.
The administrator requirement lowers the practical risk on a single site, since an administrator can usually do a lot already. The case that deserves attention is the multisite network, where a lower level admin could reach data that belongs to other sites. The record does not claim exploitation in the wild and the KEV flag is false.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Quick check
What is the fixed version?
3.2.2. The record says versions before 3.2.2 are affected.
Can a visitor exploit it?
No. The record says administrators can perform the attack.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
