PT-2026-5061 · WordPress · Easy Replace Image

Nabil Irawan · Published 2026-01-28 · Updated 2026-01-28 · CVE-2026-1298

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Replace Image plugin for WordPress versions prior to 3.5.3

Description The Easy Replace Image plugin for WordPress is susceptible to a missing authorization issue. This is caused by a lack of appropriate capability checks within the image replacement from url function, which is connected to the eri from url AJAX action. Authenticated attackers possessing Contributor-level access or higher can replace any image attachments on the website with images sourced from external URLs. This could lead to site defacement, phishing attacks, or content manipulation.

Recommendations Update the Easy Replace Image plugin to version 3.5.3 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1298

Affected Products

Easy Replace Image

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1298 · Security Note
• https://plugins.trac.wordpress.org/browser/easy-replace-image/tags/3.5.2/easy-replace-image.php#L961 · Note
• https://plugins.trac.wordpress.org/browser/easy-replace-image/trunk/easy-replace-image.php#L961 · Note
• https://twitter.com/VulmonFeeds/status/2016402166903185783 · Twitter Post
• https://twitter.com/CVEnew/status/2016388928459128971 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3447984%40easy-replace-image&new=3447984%40easy-replace-image&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/27332c13-c25f-47ec-980d-035fc35ce553?source=cve · Note
• https://t.me/cveNotify/150080 · Telegram Post