CVE-2024-4873 is an authorization bypass vulnerability in the Replace Image WordPress plugin by aspengrovestudios. The issue arises from insufficient validation of a user-controlled key in the image replacement functionality, enabling authenticated users with Author-level privileges or above to replace images uploaded by higher privileged users, including admins. This vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 4.3, reflecting a medium severity with low attack complexity and no user interaction required. The vulnerability affects all versions up to and including 1.1.10. No patch or vendor advisory has been provided to date.

An attacker with Author-level access or higher can replace images uploaded by users with higher privileges, such as administrators. This could lead to unauthorized modification of content but does not impact confidentiality or availability. The integrity of image content is compromised, potentially enabling misleading or malicious content to be displayed under trusted user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and monitor for unauthorized image modifications. Avoid granting unnecessary privileges to users to reduce risk.