Enable Media Replace <= 4.2.2 - Authenticated (Author+) Path Traversal via 'location_dir' Parameter
- ID
- WPSEC-2026-1779
- Plugin
- Enable Media Replace (enable-media-replace)
- Affected
- all versions before 4.2.3
- Remediation
- Update to 4.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- Enable Media Replace on WPSec AttackSurface
- Fix released
- Published
Description
The Enable Media Replace plugin for WordPress is vulnerable to Path Traversal via the 'location_dir' parameter in all versions up to, and including, 4.2.2. This is due to insufficient validation of the destination folder when a file is replaced into a new location: the resolved path was compared with the uploads base directory without a trailing separator, and on multisite installations the main site could target the 'sites' subfolders. This makes it possible for authenticated attackers, with Author-level access and above, to place replacement files of allowed types in directories outside their intended upload folder, such as existing sibling directories whose names start with the uploads directory name, or the upload folders of other subsites on multisite installations.
References
- https://wpsec.com/vuln/WPSEC-2026-1779/
- https://plugins.svn.wordpress.org/enable-media-replace/tags/4.2.3/
- https://wordpress.org/plugins/enable-media-replace/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS