Enable Media Replace WordPress Plugin Missing Authorization Vulnerability Allows Arbitrary Attachment Replacement

A vulnerability exists in the Enable Media Replace WordPress plugin, specifically in versions through 4.1.7. The issue arises from an improper capability check in the 'RemoveBackGroundViewController::load' function, allowing authenticated attackers with Author-level access or higher to replace any attachment with a background-removed version. This unauthorized data modification could lead to unintended changes in media files, potentially disrupting the integrity of content management.

Impact

Exploitation of this vulnerability allows for unauthorized modification of media files, as attackers can replace existing attachments with altered versions, such as those with backgrounds removed. This could disrupt content presentation or management.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access must use the Enable Media Replace plugin version 4.1.7 or earlier. The user can initiate the 'RemoveBackGroundViewController::load' function, which will improperly authorize the replacement of any attachment with a background-removed version.

Remediation

Users are advised to update the Enable Media Replace WordPress plugin to version 4.1.8 or later, where this vulnerability has been patched.