CVE-2026-85655Published
Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-85655 · Microsoft / collected KEV context
cve-program · CVE-2026-85655
- https://www.wordfence.com/threat-intel/vulnerabilities/id/aff42473-63c6-41ca-8312-058f213e2302?source=cve
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/build/shortpixel/replacer/src/Replacer.php#L250
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L59
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L66
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/Controller/ReplaceController.php#L253
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/build/shortpixel/replacer/src/Replacer.php#L250
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L59
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L66
- https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/Controller/ReplaceController.php#L253
- https://github.com/short-pixel-optimizer/enable-media-replace/releases/tag/v4.2.3
Related operational evidence
Explicit CVE identifiers- Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow · Newly collected advisory · 28 Oct 2026