SZB-8d55bb0bd5
Enable Media Replace plugin flaw CVE-2026-73186 reported (CVSS 8.8)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Enable Media Replace
- Product
- Enable Media Replace WordPress plugin
- First seen
Summary
TheHackerWire lists CVE-2026-73186, a subscriber-level PHP object injection flaw in Enable Media Replace versions 4.2.2 and earlier, rated High (8.8). The item is a vulnerability alert shared on Mastodon and does not describe observed exploitation.
If you use Enable Media Replace
Check whether the Enable Media Replace plugin is installed and what version it runs
Update to a version later than 4.2.2 once a fixed release is confirmed
Review subscriber accounts and remove untrusted users until patched
What the sources say 1
· Mastodon: “🟠 CVE-2026-73186 - High (8.8) Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.” Source