CVE-2026-114422
Received Received - Intake

PHP Object Injection in Enable Media Replace WordPress Plugin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: WPScan

Description
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-114422
EUVD
EUVD-2026-113743

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Enable Media Replace 4.1.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114422 is a PHP Object Injection vulnerability in the Enable Media Replace WordPress plugin versions 4.1.4 to 4.2.2. It allows unauthenticated users to inject a PHP object during media replacement, which is executed when a user with upload privileges performs the replacement. This can lead to local file inclusion of existing PHP or HTML files and potentially remote code execution if an attacker-controlled file is present.

Detection Guidance

Check if the Enable Media Replace plugin version is between 4.1.4 and 4.2.2. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details in /wp-content/plugins/enable-media-replace/

Monitor for unusual file access or modifications in media directories. Look for unexpected PHP or HTML file inclusions in server logs.

Impact Analysis

An attacker could exploit this to include and execute malicious PHP or HTML files on your server, potentially gaining control over your WordPress site. Users with upload privileges are at risk if an attacker exploits this flaw during media replacement.

Mitigation Strategies

Update the Enable Media Replace plugin to version 4.2.3 or later immediately to patch the vulnerability.

Restrict file upload permissions to trusted users only. Review server logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart