---
id: "CVE-2026-114422"
kind: "vulnerability"
aliases: ["CVE-2026-114422"]
title: "WordPress Enable Media Replace plugin: object injection leads to file inclusion and possible code execution"
severity: "high"
cvss: null
epss: 0.0082
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["plugin-4.2.3-or-later", "plugin-not-installed"]
published_at: "2026-10-30T06:16:44+00:00"
first_seen_at: "2026-10-30T06:28:38+00:00"
updated_at: "2026-10-30T18:23:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114422", "first_seen_at": "2026-10-30T06:28:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114422", "first_seen_at": "2026-10-30T18:23:38+00:00"}]
---

# WordPress Enable Media Replace plugin: object injection leads to file inclusion and possible code execution

The Enable Media Replace WordPress plugin deserializes stored metadata without restricting which PHP classes it can create, so an unauthenticated user can inject a PHP object. When a user with upload access runs a media replacement, the object is instantiated, enabling local file inclusion and, where an attacker-influenced PHP or HTML file exists on the server, remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; a version below `4.2.3` is affected.
- Confirm whether the site runs the plugin at all, since only sites with it installed are exposed.

## Fix

- Enable Media Replace: move to `4.2.3` or later.

## Timeline

- 2026-10-30T06:28:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114422
- 2026-10-30T18:23:38+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114422

## From the sources

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server.
This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_