7.5
HighCVSS 3.1 · from CISA
CVE-2026-114422
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
Enable Media Replace · Unsafe deserialization · CWE-502AffectedEnable Media Replace
FixUpdate to 4.2.3 or newer
PublishedOct 30, 06:00 · WPScan
Scored7.5 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
From WPScan
Affected and fixed versions
ProductAffectedFixed inEnable Media Replace4.1.4 – before 4.2.34.2.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known