Enable Media Replace EUVD-2026-114294

Requires an authenticated Subscriber-level (or higher) account on a WordPress site running Enable Media Replace <= 4.2.2, so the site must either permit user self-registration ('Anyone can register' enabled) or the attacker must otherwise obtain a low-privilege account. Exploitation sends attacker-controlled serialized data into a vulnerable deserialization path (PHP Object Injection); realized impact additionally depends on a usable POP gadget chain being present in WordPress core, this plugin, or other installed plugins/themes - the available sources do not state the exact vulnerable feature or trigger. Limiting factors: the subscriber authentication requirement (PR:L) excludes fully unauthenticated attackers, and object injection without a reachable gadget chain may yield limited or no impact.

This is a genuine but conditional priority rather than an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity flaw needing only low privileges (PR:L) and no user interaction, with high confidentiality, integrity and availability impact - consistent with PHP Object Injection (CWE-502). The critical mitigating signal is the 'Subscriber' privilege level: the attacker must hold an authenticated low-privilege account, so sites that do not allow self-registration or that lack subscriber-tier users face a materially higher barrier. Impact for object-injection flaws is also contingent on a usable POP gadget chain being present in WordPress core, this plugin, or other installed plugins/themes; the available sources do not state what the realized impact is, so the C:H/I:H/A:H rating represents worst-case potential, not a demonstrated capability. No EPSS score is provided and the flaw is not in CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_week', indicating prompt but not emergency remediation. The only reference is a Patchstack advisory database entry, not a working exploit. Net: a high-CVSS flaw whose real-world risk is tempered by the subscriber authentication requirement and gadget-chain dependency, warranting patching this week per the decision signal.

An attacker who holds or registers a Subscriber-level account on a WordPress site running Enable Media Replace <= 4.2.2 submits crafted serialized PHP object data to the vulnerable plugin function, triggering deserialization of attacker-controlled objects. If a suitable POP gadget chain exists in the installed WordPress stack, this object injection can escalate to file manipulation, data disclosure, or code execution; the exact trigger is not described in the available sources. No public exploit was identified at time of analysis.