CVE-2026-114431 in Enable Media Replace Plugin
Summary
by MITRE • 11/04/2026
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in versions of the Enable Media Replace WordPress plugin prior to version 4.2.3 represents a significant security flaw rooted in improper handling of file upload pipelines within the Content Management System architecture. This issue specifically affects authenticated users who possess media upload privileges, allowing them to bypass critical sanitization mechanisms designed to prevent malicious code execution. The core technical failure lies in the fact that when a user utilizes the replace functionality for an existing media item, the plugin fails to route the newly uploaded file through the standard WordPress upload pipeline. This deviation from expected behavior is critical because it circumvents the pre-upload filters and hooks that are responsible for validating and sanitizing incoming files before they are stored on the server or registered in the database.
The operational impact of this flaw centers on the bypassing of SVG sanitization processes. Many WordPress installations utilize plugins such as Enable Media Replace to manage media assets, often relying on specific pre-filters like those provided by an SVG sanitizer plugin to ensure that Scalable Vector Graphics files do not contain embedded JavaScript or other executable content. Because the vulnerable version of Enable Media Replace does trigger these upload pipeline filters when replacing a file, attackers can upload an SVG file containing malicious scripts. When this compromised SVG is subsequently accessed directly via its URL in a web browser, the embedded script executes within the context of the victim's session. This constitutes a Stored Cross-Site Scripting vulnerability, as the malicious payload persists on the server and affects any user who views or interacts with the affected media file.
From an industry standards perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, it relates to CWE-434, Unrestricted Upload of File with Dangerous Type, and CWE-20, Improper Input Validation, due to the failure to enforce strict type checking and sanitization during the file replacement process. In terms of threat modeling frameworks such as MITRE ATT&CK, this behavior facilitates techniques associated with Initial Access via Web Applications or Persistence through Stored XSS payloads, allowing an attacker to maintain a foothold within the application environment by leveraging trusted media assets for malicious execution.
Mitigation strategies must focus on immediate remediation and architectural hardening. The primary recommendation is to upgrade the Enable Media Replace plugin to version 4.2.3 or later, where this pipeline bypass has been corrected to ensure all replaced files pass through the necessary sanitization filters. Administrators should also audit their WordPress installations for any existing instances of uploaded SVGs that may have exploited this flaw prior to patching. Implementing strict Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting script execution sources. Additionally, enforcing server-side validation rules that reject executable content in image files regardless of client-side sanitization provides a defense-in-depth approach against similar vulnerabilities in other plugins or core functionalities.