CVE-2026-85655: Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the postcontent of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with an Author role or higher can exploit it. The affected user can modify content in published posts they would not normally be allowed to edit, including posts owned by administrators.
What does an attacker need to do to modify posts?
The attacker needs Author-level access or above and must use the media replacement workflow. Replacing media causes a database-wide search-and-replace for the old media URL in published posts, without a per-post authorization check.
How broad can the content modification be?
A single replacement request can overwrite the post_content of every published post that references the replaced media URL. The resulting changes are immediately visible to unauthenticated site visitors.
Are unauthenticated attackers affected by this authorization bypass?
No. Exploitation requires an authenticated account with at least Author-level access; the issue does not describe unauthenticated exploitation.
Which plugin versions are affected?
All versions of ShortPixel Enable Media Replace through 4.2.2, including 4.2.2, are affected.