{"id":"CVE-2023-4643","aliases":["EUVD-2023-54495","GHSA-h9gw-q7wq-vrfv"],"status":"published","title":"Enable Media Replace \u003c 4.1.3 - Author+ PHP Object Injection","description":"The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01052,"percentile":0.64583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2023-10-16T19:38:58Z","modified":"2026-06-17T06:38:17Z","products":[{"vendor":"shortpixel","product":"enable media replace"},{"vendor":"shortpixel","product":"enable_media_replace"},{"vendor":"unknown","product":"enable media replace"}],"references":[{"url":"https://wpscan.com/vulnerability/d9125604-2236-435c-a67c-07951a1fc5b1","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4643"},{"url":"https://github.com/advisories/GHSA-h9gw-q7wq-vrfv"}],"sources":{"cve":[{"id":"CVE-2023-4643","title":"Enable Media Replace \u003c 4.1.3 - Author+ PHP Object Injection","description":"The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog","status":"published","published":"2023-10-16T19:38:58.93Z","modified":"2025-04-23T16:13:57.33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:30.474787Z"}],"euvd":[{"id":"EUVD-2023-54495","description":"The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog","status":"published","published":"2023-10-16T19:38:58Z","modified":"2025-04-23T16:13:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:13.204099Z"}],"ghsa":[{"id":"GHSA-h9gw-q7wq-vrfv","title":"The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove...","description":"The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog","status":"published","published":"2023-10-16T21:30:26Z","modified":"2024-04-04T08:41:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:57:00.717739Z"}],"nvd":[{"id":"CVE-2023-4643","description":"The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog","status":"published","published":"2023-10-16T20:15:15.743Z","modified":"2026-06-17T06:38:17.1Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:08:37.83429Z"}]}}