{"id":"CVE-2026-85655","aliases":["EUVD-2026-111819","GHSA-582x-674x-hc38"],"status":"published","title":"Enable Media Replace \u003c= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow","description":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00272,"percentile":0.19748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-28T07:48:29Z","modified":"2026-11-04T23:10:00Z","products":[{"vendor":"shortpixel","product":"enable media replace"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff42473-63c6-41ca-8312-058f213e2302?source=cve","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/build/shortpixel/replacer/src/Replacer.php#L250","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L59","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L66","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/Controller/ReplaceController.php#L253","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/build/shortpixel/replacer/src/Replacer.php#L250","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L59","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L66","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/Controller/ReplaceController.php#L253","tags":["web"]},{"url":"https://github.com/short-pixel-optimizer/enable-media-replace/releases/tag/v4.2.3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85655","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-582x-674x-hc38"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85655.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-85655","title":"Enable Media Replace \u003c= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow","description":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","status":"published","published":"2026-10-28T07:48:29.42Z","modified":"2026-10-29T01:41:49.939Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-111819","description":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","status":"published","published":"2026-10-28T07:48:29Z","modified":"2026-10-29T01:41:49Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:18.489561Z"}],"ghsa":[{"id":"GHSA-582x-674x-hc38","title":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all...","description":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","status":"published","published":"2026-10-28T09:31:56Z","modified":"2026-10-28T09:32:04Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:14:33.106751Z"}],"nvd":[{"id":"CVE-2026-85655","description":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","status":"published","published":"2026-10-28T08:16:30.083Z","modified":"2026-11-04T23:10:00.223Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-05T01:45:13.070866Z"}],"osv":[{"id":"CVE-2026-85655","title":"Enable Media Replace \u003c= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow","description":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","status":"published","published":"2026-10-28T07:48:29.42Z","modified":"2026-11-05T21:16:09.672003908Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-05T22:00:58.054534Z"}]}}