Subscriber-level code execution via unrestricted function dispatch

Code injection in Better Find and Replace WordPress plugin 1.7.7 and earlier allows remote authenticated users to execute code through AJAX requests. The rtafar_ajax handler parses an attacker-controlled selector into class and method names, then dispatches the request without a strict allowlist of callable plugin functions. Subscriber-level access is sufficient, and execution is limited to privileged plugin operations reachable through the dispatcher.