A vulnerability in the Real-Time Find and Replace WordPress plugin could be exploited by attackers to create rogue admin accounts.
The Real-Time Find and Replace WordPress plugin is currently installed on over 100,000 sites, it allows users to dynamically (i.e. at the time when a page is generated) replace code and text from themes and other plugins with code and text of their choice before a page is delivered to a user’s browser.
The find and replace happens in real-time, this means that it could be done without changing plugins and themes, making upgrades easy.
