The plugin contains an authorization bypass that allows any authenticated user who can author content to replace media across all posts. This results in the attacker silently rewriting the post_content field for any published post, including those owned by administrators, and the changes become visible to all visitors immediately. The flaw is an instance of improper authorization (CWE-862) and has a CVSS score of 4.3, indicating moderate severity.

All installations of the WordPress plugin Enable Media Replace from shortpixel, versions 4.2.2 and earlier are affected. The vulnerability lies in the doReplaceQuery() method that performs a global database search and replace without per‑post capability checks.

Exploitation requires only authenticated access with author‑level rights; no special network exposure is needed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the moderate CVSS score, the risk is moderate but significant if an attacker has local editorial access and can trigger multifile replacements across a site.