CVE-2022-46850 HIGH

CVE-2022-46850: WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion

Vendor Nabil Lemsieh

Product Easy Media Replace

Weakness CWE-862 · Missing authorization

Published June 19, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Auth. (author+) Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Replace plugin <= 0.1.3 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Easy Media Replace versions up to 0.1.3 lack proper authorization checks, allowing unauthenticated attackers to disrupt the site's availability. An attacker can send network requests without authentication to trigger a denial-of-service condition. The vulnerability affects multiple users and systems due to its changed scope. No user interaction is required.

What an attacker can do

03Attacker Capabilities

Make the site unavailable or unresponsive by sending requests that consume resources or crash services.

Potential impact on your site

04Site Impact

Your site may become slow or offline if targeted; users cannot access content or functionality.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 19, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-46850 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities