CVE-2026-2732mediumCWE-862

CVE-2026-2732: falha de média gravidade em shortpixel Enable Media Replace

Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Enable Media Replace

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.3%
The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'RemoveBackGroundViewController::load' function in all versions up to, and including, 4.1.7. This makes it possible for authenticated attackers, with Author-level access and above, to replace any attachment with a removed background attachment.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
shortpixel · Enable Media Replace
CVEs relacionadas — shortpixel Enable Media Replace

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6737MEDIUMEnable Media Replace <= 4.1.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2026-85655MEDIUMEnable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement WorkflowEPSS 0.3%CVE-2026-5714MEDIUMEnable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' ParameterEPSS 0.3%CVE-2025-9496MEDIUMEnable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified ShortcodeEPSS 0.2%