{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-05T09:23:31.345","vulnerabilities":[{"cve":{"id":"CVE-2024-4873","sourceIdentifier":"security@wordfence.com","published":"2024-06-19T04:15:12.990","lastModified":"2026-06-17T08:03:04.890","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Replace Image plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.10 via the image replacement functionality due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace images uploaded by higher level users such as admins."},{"lang":"es","value":"El complemento Replace Image para WordPress es vulnerable a Insecure Direct Object Reference en todas las versiones hasta la 1.1.10 incluida a través de la funcionalidad de reemplazo de imagen debido a la falta de validación en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de autor y superior, reemplacen imágenes cargadas por usuarios de nivel superior, como administradores."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"aspengrovestudios","product":"Replace Image","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-06-20T15:27:33.168935Z","id":"CVE-2024-4873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117484%40replace-image&new=3117484%40replace-image&sfp_email=&sfph_mail=","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/replace-image/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5d3a62-f7e5-4776-bed9-7ff3f81da452?source=cve","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/replace-image/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5d3a62-f7e5-4776-bed9-7ff3f81da452?source=cve","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}