Input validation vulnerability in String locator 2.6.6

A plugin called String locator for WordPress has a security issue where untrusted information can be used to inject a harmful piece of code. This can be done by taking advantage of a function called ‘recursive_unserialize_replace’. Attackers who are not logged in can use this vulnerability to inject a PHP Object. If there is an additional plugin or theme on the website, the attacker can use it to delete files, get private information, or run code. An administrator must perform a search and replace action for the exploit to work.