CVE-2026-85655

Name of the Vulnerable Software and Affected Versions Enable Media Replace versions prior to 4.2.3

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with author-level access or higher can modify the post content of any published post that references replaced media, including posts owned by administrators. This occurs because the doReplaceQuery() function executes a database-wide search-and-replace for the old media URL without performing per-post capability checks, allowing users to overwrite content that the standard admin UI and REST API would normally restrict.

Recommendations Update Enable Media Replace to version 4.2.3 or later.