CVE-2026-85655
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Enable Media Replace plugin for WordPress in all versions up to and including 4.2.2 is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing authenticated attackers with author-level access and above to modify the post_content of any published post referencing the replaced media, including Administrator-owned posts. The doReplaceQuery() method performs a database-wide search-and-replace without per-post capability checks.
Risk Assessment
An attacker with author-level privileges can modify content of posts they normally cannot edit, including administrator posts, with changes immediately visible to visitors. This can lead to injection of malicious content or site defacement.
Recommendation
Update the Enable Media Replace plugin to a version later than 4.2.2 that fixes the authorization bypass. Until then, limit the number of users with author-level privileges or disable the plugin.
Other vulnerabilities in Enable Media Replace
See all- CVE-2026-73186High
The Enable Media Replace WordPress plugin in versions up to 4.2.2 contains a subscriber-level PHP Object Injection vulnerability.
- CVE-2026-57722Medium
The Enable Media Replace WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from n/a through 4.2.1.
- CVE-2025-9496Medium
The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS