Non notée
CVE-2022-2554 The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload…
Description
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Enable Media Replace 4.0 | premières → < 4.0.0 | 4.0.0 |
Autres CVE de Enable Media Replace
Les 5 CVE de Enable Media Replace →
CVE-2026-114431
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
6.4
Moyenne
CVE-2026-114422
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…
7.5
Élevée
CVE-2023-4643
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature,…
8.8
Élevée
CVE-2023-0255
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the…
8.8
Élevée