# CVE-2026-114422: Enable Media Replace PHP object injection in metadata deserialization

Source: https://junglewise.ai/threats/cve-2026-114422-the-enable-media-replace-wordpress-plugin-before-4-2-3-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-114422 · Severity: info · Published 2026-10-30

The Enable Media Replace WordPress plugin before version 4.2.3 improperly deserializes metadata during media operations, allowing attackers to inject malicious PHP objects. When a user with upload permissions replaces media files, the injected objects are instantiated, potentially leading to remote code execution if an attacker-controlled file exists on the server. This affects WordPress installations relying on this plugin for media management workflows.

Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2026-114422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114422 being exploited in the wild.

**How severe is CVE-2026-114422?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Wordpress Enable Media Replace 4.1.4 through 4.2.2.

**Is there a fix for CVE-2026-114422?** Yes: fixed in 4.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114422 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114422?** Check whether you run Wordpress Enable Media Replace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.3

## Technical details

The plugin fails to restrict class instantiation during deserialization of stored metadata in its media replace-and-update-links routine (CWE-502: insecure deserialization). An unauthenticated attacker can inject a malicious serialized PHP object into metadata; exploitation occurs when an authenticated user with upload access performs a routine media replacement operation, triggering instantiation of the injected object. This enables PHP object injection and local file inclusion, escalating to RCE where attacker-influenced PHP or HTML files are present.

## Affected products

- WordPress Enable Media Replace 4.1.4 through 4.2.2

## Timeline

- 2026-10-28: disclosed
- 2026-10-30: advisory

## References

- [https://wpscan.com/vulnerability/e0fa983d-19b6-438b-96c1-7ae6e8ccace4/](https://wpscan.com/vulnerability/e0fa983d-19b6-438b-96c1-7ae6e8ccace4/)