Enable Media Replace
Monthly
PHP object injection in the WordPress plugin Enable Media Replace through version 4.2.2 gives authenticated Subscriber-level users a path to high-impact compromise when a usable POP gadget chain is present. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so exposure is limited to sites where an attacker can obtain a low-privilege account, such as sites with user self-registration enabled; the exact vulnerable feature and trigger are not described in the available sources. No public exploit identified at time of analysis and no CISA KEV status is supplied, and the this_week priority label makes this a genuine but conditional priority rather than an emergency.
Authorization bypass in the WordPress plugin Enable Media Replace (all versions up to and including 4.2.2) allows an authenticated user holding the Author role or above to rewrite the post_content of published posts that reference a replaced media file - including posts owned by Administrators - with the changes immediately visible to unauthenticated site visitors. The root cause is that the plugin's doReplaceQuery() performs a database-wide search-and-replace across every post containing the old media URL without any per-post capability check, so a single Author-triggered replace request can silently overwrite many posts that WordPress's admin UI and REST API would otherwise forbid that user from editing. Severity is modest (CVSS 4.3, PR:L, integrity-only) because the actor must already hold a valid Author+ account and the rewrite is constrained to substituting the old media URL with the new one; no public exploit code has been identified at time of analysis, and the vendor has released version 4.2.3 which, among other hardening, restricts Author-role users to the standard replace option only.
Stored cross-site scripting in the ShortPixel Enable Media Replace WordPress plugin (all versions through 4.2.1) allows an authenticated attacker with high-level privileges to inject persistent malicious scripts via the media replacement workflow, which then execute in the browser context of any WordPress user who subsequently views the affected content. The scope change confirmed by the CVSS vector (S:C) means a compromised editor-level account could be leveraged to target administrator sessions, enabling privilege escalation within the WordPress admin interface. No public exploit code or CISA KEV listing has been identified at time of analysis; the Patchstack advisory is the primary confirmed intelligence source.
The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP object injection in the WordPress plugin Enable Media Replace through version 4.2.2 gives authenticated Subscriber-level users a path to high-impact compromise when a usable POP gadget chain is present. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so exposure is limited to sites where an attacker can obtain a low-privilege account, such as sites with user self-registration enabled; the exact vulnerable feature and trigger are not described in the available sources. No public exploit identified at time of analysis and no CISA KEV status is supplied, and the this_week priority label makes this a genuine but conditional priority rather than an emergency.
Authorization bypass in the WordPress plugin Enable Media Replace (all versions up to and including 4.2.2) allows an authenticated user holding the Author role or above to rewrite the post_content of published posts that reference a replaced media file - including posts owned by Administrators - with the changes immediately visible to unauthenticated site visitors. The root cause is that the plugin's doReplaceQuery() performs a database-wide search-and-replace across every post containing the old media URL without any per-post capability check, so a single Author-triggered replace request can silently overwrite many posts that WordPress's admin UI and REST API would otherwise forbid that user from editing. Severity is modest (CVSS 4.3, PR:L, integrity-only) because the actor must already hold a valid Author+ account and the rewrite is constrained to substituting the old media URL with the new one; no public exploit code has been identified at time of analysis, and the vendor has released version 4.2.3 which, among other hardening, restricts Author-role users to the standard replace option only.
Stored cross-site scripting in the ShortPixel Enable Media Replace WordPress plugin (all versions through 4.2.1) allows an authenticated attacker with high-level privileges to inject persistent malicious scripts via the media replacement workflow, which then execute in the browser context of any WordPress user who subsequently views the affected content. The scope change confirmed by the CVSS vector (S:C) means a compromised editor-level account could be leveraged to target administrator sessions, enabling privilege escalation within the WordPress admin interface. No public exploit code or CISA KEV listing has been identified at time of analysis; the Patchstack advisory is the primary confirmed intelligence source.
The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.