CVE-2024-4873 MEDIUM

CVE-2024-4873: Replace Image <= 1.1.10 - Insecure Direct Object Reference

Vendor Aspengrovestudios

Product Replace Image

Weakness CWE-639 · IDOR

Published June 19, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Replace Image plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.10 via the image replacement functionality due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace images uploaded by higher level users such as admins.

Key dates

02Disclosure timeline

June 19, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-4873 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2026-1271 ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification CVE-2024-13558 NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0 CVE-2024-52601 iTop portal Insecure Direct Object Reference vulnerability CVE-2021-3964 Authorization Bypass Through User-Controlled Key in elgg/elgg