CVE Intelligence

Iulia Cazan Easy Replace Image vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Iulia Cazan Easy Replace Image: 1 record(s), with affected versions and fixes.

CVE-2026-1298 Medium · 4.3 CWE-862 Jan 28, 2026
Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `image_replacement_from_url` function that is hooked to the `eri_from_url` AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace arbitrary image attachments on the site with images from external URLs, potentially enabling site defacement, phishing attacks, or content manipulation.