CVE-2026-85655

The Enable Media Replace plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 4.2.2 . The root cause is the doReplaceQuery() method, which fails to perform per-post capability checks when performing a database-wide search-and-replace of media URLs. This al...