{"id":"CVE-2026-114422","title":"Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer","summary":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-502"],"product":"Enable Media Replace","affected":["enable_media_replace >= 4.1.4 < 4.2.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T13:19:03.362736Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T13:26:47.999Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114422","references":[{"url":"https://wpscan.com/vulnerability/e0fa983d-19b6-438b-96c1-7ae6e8ccace4/"}],"tags":["cve.org"],"epss":0.00475,"epssPercentile":0.41316,"ingestedAt":"2026-11-05T16:07:30.269Z","slug":"CVE-2026-114422","body":"## Overview\n\nThe Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.\nThis is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.\n\n## Affected\n\n- `enable_media_replace >= 4.1.4 < 4.2.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}