Real-Time Find and Replace plugin helps to replace HTML content on WordPress sites without permanently changing the source content.
As elaborated in the blog post, the bug existed in the far_options_page function of the plugin.
The far_options_page function contains the core of the plugin’s functionality for adding new find and replace rules. Unfortunately, that function failed to use nonce verification, so the integrity of a request’s source was not verified during rule update, resulting in a Cross-Site Request Forgery vulnerability.
An attacker could replace HTML content on the target website with malicious code which could execute every time a user would navigate to the page. Through this code, the attacker could easily create new admin accounts, redirect visitors to malicious sites, and intercept session cookies.
In the most up to date version, a nonce has been added along with a check_admin_referer nonce verification function to ensure the legitimacy of the source of a request.
The plugin website changelog also states that the version 4.0.2 includes the fix for the bug. Users should thus ensure that their sites are running the latest version of the Real-Time Find and Replace plugin to avoid any exploit.
Let us know your thoughts in the comments.