Security readout for executives and security teams
Plain-English summary
CVE-2023-6737 affects the Enable Media Replace WordPress plugin through version 4.1.4. An attacker could craft a link that runs script in a victim’s browser if the victim clicks it. The attack also requires knowing an attachment ID tied to the targeted user, reducing urgency but not eliminating risk.
Executive priority
Treat this as a targeted WordPress plugin risk, not an emergency. Prioritize internet-facing sites with the plugin installed, especially sites used by administrators or content teams. Remediate through normal patch management unless local evidence shows suspicious activity.
Technical view
This is reflected cross-site scripting in Enable Media Replace via the SHORTPIXEL_DEBUG parameter. The reported root cause is insufficient input sanitization and output escaping. It is unauthenticated, network-reachable, requires user interaction, has changed scope, and requires high attack complexity because an attachment ID must be known.
Likely exposure
Exposure is likely limited to WordPress sites running Enable Media Replace version 4.1.4 or earlier. Sites without the plugin, with newer vendor-fixed versions, or where target attachment IDs are not discoverable have lower practical exposure.
Exploitation context
The source bundle does not show active exploitation, and the CVE is not marked KEV. Successful exploitation requires tricking a user into opening a crafted link and knowing an attachment ID uploaded by that user. Impact is browser-side script execution with limited confidentiality and integrity impact.
Researcher notes
The main uncertainty is the exact fixed release, which is not stated in the provided CVE text. The WordPress Trac reference suggests code changes, but validation should rely on vendor release guidance. Do not claim exploitation in the wild from this bundle.
Mitigation direction
- Inventory WordPress sites for Enable Media Replace and record installed versions.
- Update the plugin after confirming the vendor-fixed release in WordPress.org guidance.
- Disable the plugin where it is not operationally required.
- Review the referenced WordPress Trac changeset for sanitization and escaping changes.
- Monitor for requests containing the SHORTPIXEL_DEBUG parameter.
Validation and detection
- Confirm whether Enable Media Replace is installed and active on each WordPress site.
- Flag versions up to and including 4.1.4 for remediation review.
- Check web logs for unusual SHORTPIXEL_DEBUG requests.
- Assess whether attachment IDs are exposed in public pages or media workflows.
- Verify remediation against vendor release notes or the referenced Trac changeset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-6737 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N1.62.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c37d8218-6059-46f2-a5d9-d7c22486211e?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010103%40enable-media-replace%2Ftrunk&old=2990561%40enable-media-replace%2Ftrunk&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.