7.5
High
CVE-2026-114422 The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…
Description
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Enable Media Replace 4.1 | 4.1.4 → < 4.2.3 | 4.2.3 |
Other CVEs of Enable Media Replace
The 5 CVEs of Enable Media Replace →
CVE-2026-114431
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
6.4
Medium
CVE-2023-4643
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature,…
8.8
High
CVE-2023-0255
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the…
8.8
High
CVE-2022-2554
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload…
Not rated