Enable Media Replace CVE-2026-85655

Requires an authenticated account at WordPress Author role or above on the target site (CVSS PR:L), and at least one published post referencing the media URL being replaced so the search-and-replace has something to rewrite. The attacker triggers the plugin's normal media-replace action (doReplaceQuery), which runs across the whole posts table with no per-post capability check - this is default plugin behavior in all versions up to and including 4.2.2, requiring no non-default configuration and no user interaction. Limiting factors: the attacker must already have a valid Author+ account (so not remote-unauthenticated), and the modification is constrained to substituting the old media URL with the new one rather than injecting arbitrary content, which bounds the integrity impact even though many posts (including Administrator-owned ones) can be affected at once.

Severity signals are mixed and point to a real but non-emergency issue. The CVSS 3.1 base score is 4.3 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N: network-reachable, low attack complexity, no user interaction, but requiring existing authenticated access (PR:L - Author role or above per the description) and yielding only limited integrity impact with no confidentiality or availability loss. The vuln.today decision label is this_month, consistent with a medium-priority defect rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so there is no public exploit identified at time of analysis and no measured exploitation probability - EPSS is simply missing rather than low, which should be noted rather than treated as reassurance. The factor that elevates concern above the raw 4.3 is the cross-privilege nature: an Author can cause changes to Administrator-owned published posts that WordPress's standard admin UI and REST API would forbid, with the result immediately visible to unauthenticated visitors. This is a broken-authorization/defacement risk, not a code-execution or data-theft risk. The fix in v4.2.3 also mentions hardening against a possible PHP Object Injection reported by multiple teams; that is a separate concern and not what this CWE-862 authorization-bypass CVE describes, so the two should not be conflated.

An attacker holding an Author-level account on a WordPress site running Enable Media Replace ≤4.2.2 replaces a media file whose URL appears in posts they do not own. The plugin's doReplaceQuery() performs a database-wide search-and-replace of the old media URL across all posts without any per-post capability check, silently rewriting post_content of Administrator-owned published posts and surfacing the change to unauthenticated visitors. No public exploit code or PoC reference is present in the supplied data.