CVE-2026-2732
Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
概要
Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'RemoveBackGroundViewController::load' function in all versions up to, and including, 4.1.7. This makes it possible for authenticated attackers, with Author-level access and above, to replace any attachment with a removed background attachment.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web plugins.trac.wordpress.org
- web plugins.trac.wordpress.org
- web plugins.trac.wordpress.org
- web wordfence.com