Authorization Bypass in Enable Media Replace WordPress Plugin

Executive Summary

The Enable Media Replace WordPress plugin has an authorization bypass flaw in versions up to 4.2.2. It allows authenticated attackers with author-level access or higher to modify the content of any published post that references replaced media, including administrator posts. The vulnerability occurs because the plugin's doReplaceQuery() method performs a database-wide search-and-replace without checking user permissions per post.

Useful 0 Not Useful 0

Detection Guidance

Check if the Enable Media Replace plugin version is below 4.2.3. Review WordPress logs for unauthorized post content modifications or unusual database search-and-replace operations. Inspect user activity logs for actions by author-level users that may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could silently overwrite content in multiple posts, including those owned by administrators, without proper authorization. Changes become visible to all visitors immediately. This could lead to unauthorized content changes, defacement, or spreading of malicious information through your WordPress site.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Enable Media Replace plugin to version 4.2.3 or later immediately. Restrict author-level user permissions to prevent unauthorized actions. Monitor posts for unexpected content changes and review database logs for suspicious search-and-replace operations.

Useful 0 Not Useful 0