Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `image_replacement_from_url` function that is hooked to the `eri_from_url` AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace arbitrary image attachments on the site with images from external URLs, potentially enabling site defacement, phishing attacks, or content manipulation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1298 Authenticated Image Replacement Vulnerability in WordPress Easy Replace Image Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1298
Post summary
The text announces CVE‑2026‑1298, an authenticated image‑replacement vulnerability in the WordPress Easy Replace Image Plugin, without providing details on exploitation, patches, or a PoC.
CVE-2026-1298 The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks… https://www.cve.org/CVERecord?id=CVE-2026-1298
Post summary
The Easy Replace Image WordPress plugin is disclosed to have a missing authorization flaw caused by absent capability checks, affecting all versions up to 3.5.2.