{"schema":"threatline.record/2","record":{"id":"CVE-2026-85655","aliases":[],"summary":"Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow","details":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.","categories":["Unclassified"],"product":"Enable Media Replace","vendor":"shortpixel","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85655","source_modified_at":"2026-10-28T07:48:29.420Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"Enable Media Replace","vendor":"shortpixel","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.2.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T07:48:29.420Z","modified_at":"2026-10-28T07:48:29.420Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-85655","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-28T07:48:29.420Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff42473-63c6-41ca-8312-058f213e2302?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/build/shortpixel/replacer/src/Replacer.php#L250"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L59"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L66"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/Controller/ReplaceController.php#L253"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/build/shortpixel/replacer/src/Replacer.php#L250"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L59"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L66"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/Controller/ReplaceController.php#L253"},{"source":"CVE List","url":"https://github.com/short-pixel-optimizer/enable-media-replace/releases/tag/v4.2.3"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T07:48:29.420Z","content_hash":"a0ecaf1e0c25f67bdf7b1f5f6f89d456e3f60a926c69a1e3bff673442cbd595c"}}