CVE-2026-73186
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Enable Media Replace WordPress plugin in versions up to 4.2.2 contains a subscriber-level PHP Object Injection vulnerability.
Risk Assessment
A user with the subscriber role could inject PHP objects, potentially leading to remote code execution or site compromise.
Recommendation
Update the Enable Media Replace plugin to a version newer than 4.2.2 or restrict subscriber privileges until the fix is applied.
Other vulnerabilities in Enable Media Replace
See all- CVE-2026-85655Medium
The Enable Media Replace plugin for WordPress in all versions up to and including 4.2.2 is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing authenticated attackers with author-level access and above to modify the post_content of any published post referencing the replaced media, including Administrator-owned posts. The doReplaceQuery() method performs a database-wide search-and-replace without per-post capability checks.
- CVE-2026-57722Medium
The Enable Media Replace WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from n/a through 4.2.1.
- CVE-2025-9496Medium
The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS