CVE-2026-114422

Name of the Vulnerable Software and Affected Versions Enable Media Replace versions 4.1.4 through 4.2.2

Description Unauthenticated users can inject a PHP object during the media replace-and-update-links routine because the software does not restrict allowed classes when deserializing stored metadata. This PHP Object Injection occurs when a user with upload access performs a routine media replacement. The issue can lead to local file inclusion of existing PHP or HTML files, potentially escalating to remote code execution if an attacker-influenced file exists on the server. If a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present via other installed plugins or themes, it could allow the deletion of arbitrary files or the retrieval of sensitive data.

Recommendations Update Enable Media Replace to version 4.2.3 or later.