SVG File Manipulation in Enable Media Replace Plugin for WordPress
CVE-2026-114431
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 November 2026
Badges
What is CVE-2026-114431?
The Enable Media Replace plugin for WordPress prior to version 4.2.3 is susceptible to a file upload vulnerability that exploits the handling of SVG files. Specifically, the plugin fails to process replaced media files through the WordPress upload pipeline. As a result, an authenticated user with upload permissions can bypass essential security controls, allowing potentially malicious SVG files containing executable scripts to be uploaded directly. The attacker can execute code contained within the SVG file when the file is accessed, creating a significant security risk for WordPress sites using this plugin.
Affected Version(s)
Enable Media Replace 0 < 4.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.