{
 "id": "WPSEC-2026-1779",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1779/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1779/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1779/index.md",
 "title": "Enable Media Replace <= 4.2.2 - Authenticated (Author+) Path Traversal via 'location_dir' Parameter",
 "description": "The Enable Media Replace plugin for WordPress is vulnerable to Path Traversal via the 'location_dir' parameter in all versions up to, and including, 4.2.2. This is due to insufficient validation of the destination folder when a file is replaced into a new location: the resolved path was compared with the uploads base directory without a trailing separator, and on multisite installations the main site could target the 'sites' subfolders. This makes it possible for authenticated attackers, with Author-level access and above, to place replacement files of allowed types in directories outside their intended upload folder, such as existing sibling directories whose names start with the uploads directory name, or the upload folders of other subsites on multisite installations.",
 "plugin": {
  "slug": "enable-media-replace",
  "name": "Enable Media Replace",
  "full_name": "Enable Media Replace",
  "wordpress_org": "https://wordpress.org/plugins/enable-media-replace/",
  "advisories_url": "https://wpsec.com/vuln/plugin/enable-media-replace/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/enable-media-replace"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.3",
 "remediation": "Update to 4.2.3 or later.",
 "fix_released": "2026-10-26T18:51:52+00:00",
 "published": "2026-10-27T19:45:08+00:00",
 "updated": "2026-10-27T13:04:47.717155+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1779/",
  "https://plugins.svn.wordpress.org/enable-media-replace/tags/4.2.3/",
  "https://wordpress.org/plugins/enable-media-replace/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/enable-media-replace",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}