CVE-2026-114422 Details
Description
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
A PHP object injection vulnerability has been identified in the Enable Media Replace WordPress plugin, affecting versions prior to 4.2.3. The issue arises because the plugin does not properly restrict the classes allowed during the deserialization of stored metadata, particularly in the media replace-and-update-links routine. This flaw enables unauthenticated users to inject a PHP object that can be instantiated when a user with upload privileges performs a media replacement. The vulnerability leads to PHP object injection and allows local file inclusion of existing PHP or HTML files. If an injected object references a PHP or HTML file influenced by the attacker, this could be escalated to remote code execution.
Users are advised to update the Enable Media Replace WordPress plugin to version 4.2.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/e0fa983d-19b6-438b-96c1-7ae6e8ccace4/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Enable Media Replace | >= 4.1.4, <= 4.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |