Enable Media Replace CVE-2026-114422

Exploitation requires the plugin's 'replace media and update links' routine to be invoked by a user who holds upload access - the deserialization only occurs during that specific media-replacement workflow, so unauthenticated injection alone is inert until a privileged user acts (UI:R). Full escalation to RCE additionally requires that an attacker-influenced PHP or HTML file already be present on the server for the local file inclusion to execute; without such a file the impact is limited to object injection and LFI of existing files. Limiting factors: affected versions are specifically 4.1.4 through <4.2.3 (4.1.3 and earlier, and 4.2.3+, are not affected), the AC:H rating reflects the chained prerequisites, and no automated/scalable exploitation is possible (SSVC Automatable: no). The exact trigger beyond 'unrestricted class deserialization of stored metadata' is as described in the advisory.

Signals point to a serious-but-conditional issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5 HIGH) describes a network-reachable flaw that an unauthenticated actor can seed (PR:N) but that only fires when a user with upload access performs a media replacement (UI:R) and that carries high attack complexity (AC:H), consistent with the chained prerequisites in the description. SSVC reinforces this: Technical Impact is 'total' (full object injection leading to LFI/RCE) but Exploitation is 'none' (no observed exploitation) and Automatable is 'no' - it cannot be sprayed at scale because a privileged human action is the trigger. EPSS of 0.82% (57th percentile) is low-to-moderate and aligns with the SSVC 'none'/'no' reading: no evidence of imminent mass exploitation. There is no CISA KEV listing, and no PoC is confirmed as working exploit code in the input (only a WPScan advisory reference). The one notable amplifier is that this is an explicit REGRESSION of CVE-2023-4643 (fixed in 4.1.3, reintroduced in 4.1.4) - a previously-patched, well-documented bug class, which lowers the research barrier for anyone who studies the prior advisory. Net: the vendor/aggregator priority of 'this_week' is a reasonable middle ground - patch promptly because impact is total and the gadget/technique is already public from the 2023 fix, but the UI:R + AC:H + Automatable:no combination makes widespread opportunistic exploitation unlikely.

An unauthenticated attacker submits input that is stored as media metadata containing a serialized PHP object payload. Later, a legitimate user with upload access runs the plugin's replace-and-update-links routine, which deserializes the stored metadata without class restrictions, instantiating the attacker's object (PHP Object Injection) and triggering local file inclusion of an existing PHP/HTML file; where an attacker-influenced PHP or HTML file already exists on the server, this escalates to remote code execution. No confirmed working exploit code is identified in the input, though a WPScan advisory reference exists and the bug is a known regression.