PHP Object Injection Vulnerability in Enable Media Replace Plugin by WordPress
CVE-2026-73186

8.8HIGH

Key Information:

Vendor

WordPress
Status
Enable Media Replace
Vendor
CVE Published:
30 October 2026

What is CVE-2026-73186?

The Enable Media Replace plugin for WordPress contains a PHP Object Injection vulnerability. This issue affects all versions up to 4.2.2, allowing malicious users to manipulate objects and potentially disrupt the application's functionality. An attacker could exploit this flaw to execute arbitrary PHP code through crafted input, posing a severe risk to WordPress installations utilizing this plugin. It's imperative for users to review their plugin versions and apply necessary security patches to safeguard against potential exploitation.

Affected Version(s)

Enable Media Replace <= 4.2.2

References

https://patchstack.com/database/wordpress/plugin/enable-m...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Asim Alshaya | Patchstack Bug Bounty Program
.