CVE-2023-0255: Shortpixel Enable Media Replace

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.

Affected products

• Shortpixel Enable Media Replace: before 4.0.2 (fixed in 4.0.2)

Published 2023-02-13. Last modified 2026-06-17.