CVE-2026-114431 · Package
NO FIX YET · SEE WHAT TO DO
The Enable Media Replace WordPress plugin before 4.2.3 replaces media files without running them through the WordPress upload filter, so SVG sanitizing is skipped. An authenticated user with upload access can store an SVG containing script that runs when the file is opened directly.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Enable Media Replace WordPress plugin before 4.2.3 with SVG support enabled, where some users can upload media. The replace path is the entry point, so sites without SVG support enabled or without untrusted upload users are less exposed. unknown whether the sources list further conditions.
Not affected if no-untrusted-uploaders, svg-support-disabled
Who cares php, self-hosted, wordpress
4.2.3.4.2.3 or later.The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
This page as .md · .json · in your agent: get_signal("CVE-2026-114431")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.