Live › vulnerability › CVE-2026-73186
Enable Media Replace, a WordPress plugin, up to and including version 4.2.2 has a PHP object injection flaw reachable by users with the Subscriber role. Object injection can let an attacker run code or alter application logic on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running Enable Media Replace at version 4.2.2 or earlier that also let people hold a Subscriber account, including sites with open registration. Sites without this plugin, or with it at a later version, are not affected. The sources do not describe the exact vulnerable code path.
No product ranges from the sources yet.
wp plugin get enable-media-replace4.2.2; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-73186")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.