Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114422— Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

Quick assessment

Affected
Unknown Enable Media Replace
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Enable Media Replace WordPress 插件在 4.2.3 版本之前，在其“媒体替换并更新链接”流程中，对反序列化存储元数据时允许使用的类未进行限制。这使得未认证用户能够注入 PHP 对象；当拥有上传权限的用户执行常规媒体替换操作时，该对象会被实例化，从而导致 PHP 对象注入以及本地包含服务器上已存在的 PHP 或 HTML 文件。若服务器上存在由攻击者控制的 PHP 或 HTML 文件，此漏洞可被进一步利用以实现远程代码执行。 此漏洞是 CVE-2023-4643 的回归问题：该漏洞曾在

AI Predicted 9.8 Difficulty: Moderate EPSS 0.82% · P57

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Enable Media Replace 4.1.4< 4.2.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114422

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
Source: CVE Program / CVE List V5
Vulnerability Description
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Enable Media Replace 4.1.4 ~ 4.2.3 -

II. Public POCs for CVE-2026-114422

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114422

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-30 · 12 CVEs total

CVE-2026-111578 7.5 HIGH PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS
CVE-2026-117572 WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
CVE-2026-118071 Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
CVE-2026-118100 BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
CVE-2026-118072 Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklis
CVE-2026-118165 Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
CVE-2026-117571 WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker D
CVE-2026-114443 Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator Ap
CVE-2026-114444 Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer
CVE-2026-115277 WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter

IV. Related Vulnerabilities

Same product: Enable Media Replace
Same vendor: Unknown