PHP Object Injection Vulnerability in Enable Media Replace Plugin for WordPress
CVE-2026-114422
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 October 2026
Badges
What is CVE-2026-114422?
The Enable Media Replace plugin for WordPress prior to version 4.2.3 contains a vulnerability that allows unauthenticated users to exploit the deserialization of stored metadata. This flaw occurs during the media replacement process, where the plugin fails to properly restrict allowed classes. As a result, an attacker can inject a malicious PHP object when a legitimate user with upload access performs a routine media replacement. This vulnerability can lead to local file inclusion of existing PHP or HTML files, potentially escalating to remote code execution if the server contains an attacker-influenced file.
Affected Version(s)
Enable Media Replace 4.1.4 < 4.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.