CVE-2026-114422

The Enable Media Replace WordPress plugin (versions before 4.2.3 ) is vulnerable to PHP Object Injection and Local File Inclusion (LFI). The root cause is the lack of restrictions on allowed classes during the deserialization of stored metadata in the media replace-and-update-links routine. This ...