{"id":"CVE-2026-85655","kind":"vulnerability","aliases":["CVE-2026-85655"],"related":[],"title":"Enable Media Replace WordPress plugin lets authors edit any published post","description":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","summary":"Enable Media Replace up to and including 4.2.2 skips per-post permission checks when replacing media, so an author-level account can rewrite post content across the site, including posts owned by administrators. The change appears immediately to unauthenticated visitors.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-author-accounts","plugin-updated"],"how_to_check":"- Check the installed version of the Enable Media Replace plugin in the WordPress admin under Plugins, or with `wp plugin get enable-media-replace --field=version`\n- Review which accounts have author role or above and whether untrusted users can create content","fix":"- Update Enable Media Replace to a version later than `4.2.2`\n- Until updated, limit or remove author-level accounts that do not need them","status":"open","published_at":"2026-10-28T08:16:30+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","triaged_at":"2026-10-28T08:33:50+00:00","updated_at":"2026-10-28T08:33:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T08:33:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update Enable Media Replace to a version later than `4.2.2`\n- Until updated, limit or remove author-level accounts that do not need them","reach":"internet","title":"Enable Media Replace WordPress plugin lets authors edit any published post","impact":"medium","summary":"Enable Media Replace up to and including 4.2.2 skips per-post permission checks when replacing media, so an author-level account can rewrite post content across the site, including posts owned by administrators. The change appears immediately to unauthenticated visitors.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authors rewrite published post content site-wide, including administrator posts","analyst_note":"","how_to_check":"- Check the installed version of the Enable Media Replace plugin in the WordPress admin under Plugins, or with `wp plugin get enable-media-replace --field=version`\n- Review which accounts have author role or above and whether untrusted users can create content","needs_analyst":false,"not_affected_if":["plugin-updated","no-author-accounts"],"who_is_affected":"Sites running Enable Media Replace at version 4.2.2 or earlier where users with author role or higher can log in. Sites without the plugin, or with it on a version above 4.2.2, are not affected by this description. Sites where only trusted editors and administrators hold accounts face much less risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3465,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-85655':14A,17A '4.2.2':33B,87C 'access':117C 'account':48B 'across':53B,157C 'action':105C 'admin':191C 'administr':60B,135C 'administrator-own':134C 'api':195C 'appear':63B 'attack':112C 'authent':111C 'author':7A,46B,78C,101C,115C,176C 'author-level':45B,114C 'author-trigg':175C 'bypass':79C 'capabl':170C 'chang':62B,139C 'check':39B,171C 'contain':160C 'content':52B,124C 'cve':12A,15A 'databas':151C 'database-wid':150C 'doreplacequeri':146C 'due':90C 'edit':8A,202C 'enabl':1A,26B,69C 'forbid':198C 'host':21B 'immedi':64B,140C 'includ':32B,56B,86C,133C 'larg':183C 'let':6A 'level':47B,116C 'make':107C,138C 'mean':172C 'media':2A,27B,42B,70C,132C,163C 'method':147C 'modifi':121C 'number':184C 'old':162C 'otherwis':197C 'overwrit':181C 'own':58B,136C 'packag':18B 'per':36B,168C 'per-post':35B,167C 'perform':103C,148C 'permiss':38B 'plugin':5A,25B,72C,93C 'possibl':109C 'post':11A,37B,51B,57B,123C,128C,137C,159C,169C,186C 'proper':95C 'publish':10A,127C 'referenc':129C 'replac':3A,28B,41B,71C,131C,156C 'request':178C 'rest':194C 'rewrit':50B 'search':154C 'search-and-replac':153C 'self':20B 'self-host':19B 'silent':180C 'singl':174C 'site':55B 'skip':34B 'standard':190C 'trigger':177C 'ui':192C 'unauthent':66B,143C 'url':164C 'user':99C,200C 'verifi':96C 'version':82C 'visibl':141C 'visitor':67B,144C 'vulner':76C 'wide':152C 'without':165C 'wordpress':4A,22B,24B,74C,188C 'wordpress-plugin':23B 'would':196C","nicknames":[],"mitigations":[],"who_affected":"Sites running Enable Media Replace at version 4.2.2 or earlier where users with author role or higher can log in. Sites without the plugin, or with it on a version above 4.2.2, are not affected by this description. Sites where only trusted editors and administrators hold accounts face much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T08:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85655","severity":null,"published_at":"2026-10-28T08:16:30+00:00","modified_at":"2026-10-28T08:16:30+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","fetched_at":"2026-10-28T08:31:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}