Enable Media Replace WordPress plugin: PHP Object Injection by Subscriber users

Summary

The Enable Media Replace WordPress plugin up to and including version 4.2.2 contains a PHP Object Injection vulnerability (CWE-502) that can be triggered by users with the Subscriber role. An authenticated attacker with a low-privileged account may be able to manipulate how the site processes serialized data, which can lead to code execution, data manipulation or denial of service on the server. The attack requires a valid Subscriber account on the website, so sites without open registration have a smaller exposure. The CVSS base score is 8.8 according to the CNA; VulDB rates it 6.3, and the exact code path is not verified.

Affected

• Enable Media Replace WordPress plugin (ShortPixel) versions 4.2.2 and earlier
• Required privilege: Subscriber (according to the CVE record and Patchstack; other sources conflict)

Fixed in

• Version 4.2.3 (according to Patchstack and the WordPress.org changelog, dated October 26, 2026; the changelog does not name this CVE)

Workaround

• No vendor-approved workaround is known.
• Remove or restrict Subscriber accounts and disable open user registration until the plugin is updated.
• Disabling the plugin until it is updated removes the exposure.

Exploitation

• Not known to be exploited according to OffSeq; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Patchstack describes the vulnerability as high priority and expects exploitation; a public Nuclei detection template is reportedly available.
• No public proof of concept found; this is not confirmed absent.

Our recommendation

• Inventory all WordPress sites with Enable Media Replace and record the installed version.
• Update the plugin to version 4.2.3 or later, or deactivate it until the update is possible.
• Review Subscriber accounts and user registration settings on affected sites.
• Check the Patchstack advisory and NVD again in a few days, as the record is still Deferred and privilege and version details may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• WordPress.org plugin page wordpress.org
• WPScan plugin entry wpscan.com
• Wordfence threat intel www.wordfence.com
• OffSeq radar entry radar.offseq.com
• Strix CVE entry www.strix.ai
• VulDB entry vuldb.com
• Vulners PT-2026-133791 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:41.