{"id":"CVE-2026-114422","kind":"vulnerability","aliases":["CVE-2026-114422"],"related":[],"title":"WordPress Enable Media Replace plugin: object injection leads to file inclusion and possible code execution","description":"The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.\nThis is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.","summary":"The Enable Media Replace WordPress plugin deserializes stored metadata without restricting which PHP classes it can create, so an unauthenticated user can inject a PHP object. When a user with upload access runs a media replacement, the object is instantiated, enabling local file inclusion and, where an attacker-influenced PHP or HTML file exists on the server, remote code execution.","severity":"high","cvss":null,"epss":0.0082,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["plugin-4.2.3-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; a version below `4.2.3` is affected.\n- Confirm whether the site runs the plugin at all, since only sites with it installed are exposed.","fix":"- Enable Media Replace: move to `4.2.3` or later.","status":"open","published_at":"2026-10-30T06:16:44+00:00","first_seen_at":"2026-10-30T06:28:38+00:00","triaged_at":"2026-10-30T06:30:09+00:00","updated_at":"2026-10-30T18:23:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:30:09Z","model":"claude-haiku-5-5","output":{"fix":"- Enable Media Replace: move to `4.2.3` or later.","reach":"internet","title":"WordPress Enable Media Replace plugin: object injection leads to file inclusion and possible code execution","impact":"high","summary":"The Enable Media Replace WordPress plugin deserializes stored metadata without restricting which PHP classes it can create, so an unauthenticated user can inject a PHP object. When a user with upload access runs a media replacement, the object is instantiated, enabling local file inclusion and, where an attacker-influenced PHP or HTML file exists on the server, remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads server files and may run code on the server","analyst_note":"Confirm the exploitation path and whether a public exploit exists; check the NVD entry and the plugin's changelog for the 4.2.3 fix and the 4.1.3 regression history.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; a version below `4.2.3` is affected.\n- Confirm whether the site runs the plugin at all, since only sites with it installed are exposed.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-4.2.3-or-later"],"who_is_affected":"Any WordPress site running Enable Media Replace before `4.2.3` is exposed. The risk is highest where users with upload access perform media replacements and where the server holds PHP or HTML files an attacker could influence. Sites without the plugin installed are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4231,"output_tokens":626,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114422':18A,21A '-2023':179C '-2026':17A,20A '-4643':180C '4.1.3':185C '4.1.4':189C '4.2.3':96C 'access':59B,132C 'allow':102C,116C 'attack':76B,162C 'attacker-influenc':75B,161C 'class':41B,101C 'code':14A,87B,157C 'creat':44B 'cve':16A,19A,178C 'deseri':34B,104C 'enabl':2A,29B,68B,90C 'escal':154C 'execut':15A,88B,158C 'exist':82B,148C 'file':10A,70B,81B,145C,150C,167C 'fix':183C 'host':26B 'html':80B,166C 'inclus':11A,71B,146C 'influenc':77B,163C 'inject':7A,50B,120C,142C 'instanti':67B,126C 'lead':8A 'link':114C 'local':69B,144C 'media':3A,30B,62B,91C,109C,136C 'metadata':36B,106C 'object':6A,53B,65B,123C,141C 'packag':22B 'perform':133C 'php':23B,40B,52B,78B,122C,140C,164C 'php/html':149C 'plugin':5A,33B,94C 'possibl':13A 'present':169C 'regress':176C 'reintroduc':187C 'remot':86B,156C 'replac':4A,31B,63B,92C,111C,137C 'replace-and-update-link':110C 'restrict':38B,99C 'result':138C 'routin':115C,135C 'run':60B 'self':25B 'self-host':24B 'server':85B,172C 'store':35B,105C 'unauthent':47B,117C 'updat':113C 'upload':58B,131C 'user':48B,56B,118C,129C 'without':37B 'wordpress':1A,27B,32B,93C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running Enable Media Replace before `4.2.3` is exposed. The risk is highest where users with upload access perform media replacements and where the server holds PHP or HTML files an attacker could influence. Sites without the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114422","severity":null,"published_at":"2026-10-30T06:16:44+00:00","modified_at":"2026-10-30T06:16:44+00:00","first_seen_at":"2026-10-30T06:28:38+00:00","fetched_at":"2026-10-30T06:28:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114422","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114422","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T18:23:38+00:00","fetched_at":"2026-10-30T18:23:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}