CVE-2023-4643

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p56

Published

Oct 16, 2023 (Oct 16, 2023)

Modified

Jun 17, 2026

Description

The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog

Vendors: shortpixel
Products: enable media replace
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.