title: Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload
description: The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
vendor: Unknown
product: Enable Media Replace
versions:
status: affected, versionType: custom, version: 0, lessThan: 4.0.2
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}