The Enable Media Replace plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 4.2.2. This flaw allows authenticated users with author-level access or higher to modify the content of any published post referencing replaced media, including posts owned by administrators. The vulnerability arises because the plugin's doReplaceQuery() method performs a database-wide search-and-replace without verifying user permissions on each post. Changes made via this method become immediately visible to all visitors.