7.5
Élevée
CVE-2026-114422 The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…
Description
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Enable Media Replace 4.1 | 4.1.4 → < 4.2.3 | 4.2.3 |
Autres CVE de Enable Media Replace
Les 5 CVE de Enable Media Replace →
CVE-2026-114431
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
6.4
Moyenne
CVE-2023-4643
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature,…
8.8
Élevée
CVE-2023-0255
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the…
8.8
Élevée
CVE-2022-2554
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload…
Non notée