Authorization Bypass in Enable Media Replace Plugin for WordPress

CVE-2026-85655

What is CVE-2026-85655?

The Enable Media Replace plugin for WordPress exhibits a critical flaw where it fails to properly authenticate authorization for user actions. This vulnerability allows authenticated users with author-level access or higher to perform unauthorized modifications to the content of any published post linked with the replaced media. Such actions can affect posts owned by administrators and are executed through the doReplaceQuery() method, which conducts a database-wide search-and-replace without adequate per-post checks. As a result, a single action by an authorized user could lead to mass content alterations, visible to all visitors without proper oversight. This scenario highlights the necessity for stringent permission checks in WordPress plugins to prevent potential abuse.

References