{"id":"CVE-2026-114422","aliases":["EUVD-2026-113743","GHSA-57rw-qx68-p67c"],"status":"published","title":"Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer","description":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.\nThis is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00475,"percentile":0.41577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-10-30T06:00:22Z","modified":"2026-10-30T17:49:38Z","products":[{"vendor":"shortpixel","product":"enable media replace"},{"vendor":"unknown","product":"enable media replace"}],"references":[{"url":"https://wpscan.com/vulnerability/e0fa983d-19b6-438b-96c1-7ae6e8ccace4/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114422"},{"url":"https://wpscan.com/vulnerability/e0fa983d-19b6-438b-96c1-7ae6e8ccace4"},{"url":"https://github.com/advisories/GHSA-57rw-qx68-p67c"}],"sources":{"cve":[{"id":"CVE-2026-114422","title":"Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer","description":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.\nThis is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.","status":"published","published":"2026-10-30T06:00:22.558Z","modified":"2026-10-30T13:26:47.999Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-113743","description":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.\nThis is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.","status":"published","published":"2026-10-30T06:00:22Z","modified":"2026-10-30T13:26:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:06.607412Z"}],"ghsa":[{"id":"GHSA-57rw-qx68-p67c","title":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when...","description":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.\nThis is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.","status":"published","published":"2026-10-30T06:32:02Z","modified":"2026-10-30T15:34:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:14:49.690154Z"}],"nvd":[{"id":"CVE-2026-114422","description":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.\nThis is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.","status":"published","published":"2026-10-30T06:16:44.77Z","modified":"2026-10-30T17:49:38.703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:13:04.940026Z"}]}}