CVE-2026-1298

The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `image_replacement_from_url` function that is hooked to the `eri_from_url` AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace arbitrary image attachments on the site with images from external URLs, potentially enabling site defacement, phishing attacks, or content manipulation.

• CWE-862

• https://plugins.trac.wordpress.org/browser/easy-replace-image/tags/3.5.2/easy-replace-image.php#L961
• https://plugins.trac.wordpress.org/browser/easy-replace-image/trunk/easy-replace-image.php#L961
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3447984%40easy-replace-image&new=3447984%40easy-replace-image&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/27332c13-c25f-47ec-980d-035fc35ce553?source=cve

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12972The PayPlus Payment Gateway WordPress plugin before 8.2.2 do…5.3
• CVE-2026-12973The PayPlus Payment Gateway WordPress plugin before 8.2.2 do…6.5
• CVE-2026-12975A flaw was found in Apicurio Registry. The ContentTypeUtil.i…8.5
• CVE-2026-12976The LearnPress WordPress plugin before 4.4.4 does not verif…
• CVE-2026-12978The FunnelKit WordPress plugin before 3.15.0.6 does not esc…7.1
• CVE-2026-12979The FunnelKit WordPress plugin before 3.15.0.6 does not val…5.5
• CVE-2026-12981The CAFEHAUS API WordPress plugin through 1.0.0 does not hav…7.5
• CVE-2026-12982The Document Gallery WordPress plugin before 5.1.1 does not …6.1
• CVE-2026-12984Insufficiently Protected Credentials vulnerability in Zyxel …8.2
• CVE-2026-12986A critical vulnerability in Admin GUI in Payara Server Full …7.3
• CVE-2026-12987The Events Manager WordPress plugin before 7.3.7 does not s…7.5
• CVE-2026-12988The WP 2FA WordPress plugin before 3.1.1.2 does not verify …6.4