Easy Replace Image
Easy Replace Image has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (50%). Other recurring categories include Server-Side Request Forgery (SSRF).
Every one of the 2 issues recorded for Easy Replace Image has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Easy Replace Image is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-47483Easy Replace Image <= 3.5.0 - Authenticated (Contributor+) Server-Side Request Forgery
Read the full analysisVulnerability Records
Easy Replace Image
Author
Iulia Cazan
This plugin allows you to replace an attachment file by uploading another image or by downloading one from a specified URL, without deleting the attachment. The plugin handles the sub-sizes generation and the attachment metadata update, and you will see the result right away. Demo License This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C