High · 8.8 CVE-2026-73186 EUVD-2026-114294GHSA-g6cf-mrxg-xvmr

WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability

Published Oct 30, 2026 · Updated Oct 30, 2026 · Assigned by Patchstack

Vendor: ShortPixel Product: Enable Media Replace

Description

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

Affected products

Vendor	Product	Affected	Fixed
ShortPixel	Enable Media Replace	≤ 4.2.2	—

References

https://patchstack.com/database/wordpress/plugin/enable-media-replace/vulnerability/wordpress-enable-media-replace-plugin-4-2-2-php-object-injection-vulnerability?_s_id=cve vdb-entry