Enable Media Replace
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:enable_media_replace:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Enable Media Replace (13debbf4-cdba-52fb-99ac-65d8bb2f89ec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114422 |
vulnerable | 2026-11-03 10:15:52.892291 |
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.
This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
Published: 2026-10-30T06:00:22.558Z
Updated: 2026-10-30T13:26:47.999Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4643 |
vulnerable | 2026-06-08 06:16:14.063245 |
Enable Media Replace < 4.1.3 - Author+ PHP Object Injection
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
Published: 2023-10-16T19:38:58.930Z
Updated: 2025-04-23T16:13:57.330Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0255 |
vulnerable | 2026-06-08 05:52:04.611262 |
Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
Published: 2023-02-13T14:32:21.404Z
Updated: 2025-03-21T15:24:56.742Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2554 |
vulnerable | 2026-06-08 05:43:35.792958 |
Enable Media Replace < 4.0.0 - Admin+ Path Traversal
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example
Published: 2022-10-10T00:00:00.000Z
Updated: 2024-08-03T00:39:08.043Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.