The Enable Media Replace plugin suffers from an improper capability check in the RemoveBackGroundViewController::load function. Because of this flaw, an authenticated user with Author level access or higher can invoke the background replacement routine on any attachment, resulting in the original media file being overwritten with a background‑removed variant. This allows a legitimate contributor or attacker to modify or destroy content that they should not be able to alter, potentially causing integrity violations and loss of media assets.

All installations of the Enable Media Replace WordPress plugin from shortpixel that are at version 4.1.7 or earlier are affected. The plugin is commonly used on WordPress sites that manage media libraries and provide background removal features.

The flaw is rated with a CVSS score of 5.4, indicating moderate severity. The EPSS score is less than 1%, suggesting a very low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with Author or higher capabilities; unauthenticated attackers cannot trigger the vulnerability. Therefore, the attack vector is credential‑based, with the potential impact limited to the scope of the attacker’s privileges but still allowing significant content tampering.