CVE-2022-46850
📋 TL;DR
This vulnerability allows authenticated WordPress users with at least author-level permissions to delete arbitrary files on the server through the Easy Media Replace plugin. It affects WordPress sites running plugin versions 0.1.3 and earlier. The broken access control flaw enables unauthorized file deletion beyond intended media file operations.
💻 Affected Systems
- WordPress Easy Media Replace Plugin
📦 What is this software?
Easy Media Replace by Easy Media Replace Project
⚠️ Risk & Real-World Impact
Worst Case
Complete website compromise through deletion of critical system files, configuration files, or database files, leading to site unavailability, data loss, or privilege escalation.
Likely Case
Malicious authors deleting important media files, theme files, or plugin files, causing website functionality issues or defacement.
If Mitigated
Limited impact with proper file permissions and regular backups, though some disruption may occur from deleted non-critical files.
🎯 Exploit Status
Exploitation requires authenticated access with author privileges. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.4 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/easy-media-replace/wordpress-easy-media-replace-plugin-0-1-3-arbitrary-file-deletion
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Easy Media Replace. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 0.1.4+ from WordPress.org and replace plugin files via FTP/SFTP.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily deactivate the Easy Media Replace plugin until patched.
wp plugin deactivate easy-media-replace
Restrict Author Roles
allRemove author roles from untrusted users or limit author permissions.
🧯 If You Can't Patch
- Implement strict file permissions (e.g., 644 for files, 755 for directories) to limit damage from arbitrary deletion.
- Enable comprehensive file integrity monitoring and maintain recent backups to restore deleted files quickly.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Easy Media Replace for version number. If version is 0.1.3 or lower, you are vulnerable.Check Version:
wp plugin get easy-media-replace --field=versionVerify Fix Applied:
After updating, confirm plugin version is 0.1.4 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in WordPress logs
- Multiple DELETE requests to wp-admin/admin-ajax.php with file parameters
- Author users performing media operations outside normal patterns
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=easy_media_replace_delete and suspicious file paths
SIEM Query:
source="wordpress.log" AND "DELETE" AND "easy_media_replace" AND NOT "wp-content/uploads"