CVE-2026-1298
Unknown Unknown - Not Provided
Missing Authorization in Easy Replace Image Plugin Allows Image Replacement

Publication date: 2026-01-28

Last updated on: 2026-04-08

Assigner: Wordfence

Description
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `image_replacement_from_url` function that is hooked to the `eri_from_url` AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace arbitrary image attachments on the site with images from external URLs, potentially enabling site defacement, phishing attacks, or content manipulation.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-28
Last Modified
2026-04-08
Generated
2026-06-16
AI Q&A
2026-01-29
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1298
EUVD
EUVD-2026-4865
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
easy_replace_image plugin to 3.5.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Easy Replace Image plugin for WordPress has a vulnerability due to missing authorization checks in the function that handles image replacement from URLs. This allows authenticated users with Contributor-level access or higher to replace any image attachments on the site with images from external URLs without proper permission checks.

Impact Analysis

This vulnerability can allow attackers with Contributor-level access to replace images on the site with arbitrary external images, potentially leading to site defacement, phishing attacks, or manipulation of site content.

Mitigation Strategies

To mitigate this vulnerability, immediately update the Easy Replace Image plugin to a version later than 3.5.2 where the missing authorization checks are fixed. Additionally, restrict Contributor-level access and above to trusted users only, and monitor for unauthorized image replacements. If an update is not available, consider disabling the plugin or the 'eri_from_url' AJAX action to prevent exploitation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1298. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart