PT-2026-5061 · WordPress · Easy Replace Image

Nabil Irawan · CVE-2026-1298 · Publicado 2026-01-28 · Atualizado 2026-01-28

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Replace Image plugin for WordPress versions prior to 3.5.3

Description The Easy Replace Image plugin for WordPress is susceptible to a missing authorization issue. This is caused by a lack of appropriate capability checks within the image replacement from url function, which is connected to the eri from url AJAX action. Authenticated attackers possessing Contributor-level access or higher can replace any image attachments on the website with images sourced from external URLs. This could lead to site defacement, phishing attacks, or content manipulation.

Recommendations Update the Easy Replace Image plugin to version 3.5.3 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1298

Produtos afetados

Easy Replace Image

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1298 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/easy-replace-image/tags/3.5.2/easy-replace-image.php#L961 · Nota
• https://plugins.trac.wordpress.org/browser/easy-replace-image/trunk/easy-replace-image.php#L961 · Nota
• https://twitter.com/VulmonFeeds/status/2016402166903185783 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2016388928459128971 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3447984%40easy-replace-image&new=3447984%40easy-replace-image&sfp_email=&sfph_mail= · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/27332c13-c25f-47ec-980d-035fc35ce553?source=cve · Nota
• https://t.me/cveNotify/150080 · Publicação no Telegram