# CVE-2026-73186: Enable Media Replace PHP object injection

Source: https://junglewise.ai/threats/cve-2026-73186-subscriber-php-object-injection-in-enable-media-replace-4-2-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-73186 · Severity: high · CVSS 8.8 · Published 2026-10-30

Enable Media Replace is a WordPress plugin that allows administrators to replace media files on their website. A PHP object injection vulnerability in versions 4.2.2 and earlier allows attackers with subscriber-level access to manipulate how the site processes data and execute arbitrary actions on the server. This could lead to unauthorized code execution, data theft, or website compromise.

Technologies: [ShortPixel Enable Media Replace](https://junglewise.ai/threats/technologies/enable-media-replace). Vendors: [ShortPixel](https://junglewise.ai/threats/vendors/shortpixel).

## Quick answers

**Is CVE-2026-73186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73186 being exploited in the wild.

**How severe is CVE-2026-73186?** High severity, with a CVSS score of 8.8, published 30 October 2026.

**Which products and versions are affected?** ShortPixel Enable Media Replace 4.2.2 and earlier.

**Is there a fix for CVE-2026-73186?** Yes: fixed in 4.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73186 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73186?** Check whether you run ShortPixel Enable Media Replace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.3

## Technical details

A PHP object injection vulnerability exists in Enable Media Replace <= 4.2.2 that allows attackers with subscriber-level privileges to inject malicious serialized objects. By exploiting unsafe deserialization, an attacker can manipulate object instantiation to execute arbitrary server-side code. The vulnerability requires subscriber access but no additional user interaction.

## Affected products

- ShortPixel Enable Media Replace 4.2.2 and earlier

## Timeline

- 2026-10-30: disclosed
- 2026-10-30: advisory: Patchstack published vulnerability details
- 2026-10-30: patched: Version 4.2.3 released with fix

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/enable-media-replace/vulnerability/wordpress-enable-media-replace-plugin-4-2-2-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/enable-media-replace/vulnerability/wordpress-enable-media-replace-plugin-4-2-2-php-object-injection-vulnerability?_s_id=cve)

## Related threats

- [ShortPixel Enable Media Replace Stored XSS](https://junglewise.ai/threats/cve-2026-57722-shortpixel-enable-media-replace-stored-xss)
- [ShortPixel Enable Media Replace stored XSS in location_dir parameter](https://junglewise.ai/threats/cve-2026-5714-shortpixel-enable-media-replace-stored-xss-in-location-dir)