What Enable Media Replace does in your Media Library
Enable Media Replace swaps the file behind an existing Media Library item for a new one, without changing the attachment ID. Without a plugin, updating an image or a PDF usually means deleting the item, uploading a file with the same name, then fixing every piece of content that used it. With the plugin, a “Replace media” link appears under each file in the list view of Media > Library, and the attachment edit screen gets a box with an “Upload a new file” button.
The replacement screen offers two modes. “Just replace the file” keeps the file name and URL: the new file must be the same type, and every page that shows it displays the new version right away. “Replace the file, use the new file name, and update all links” takes the name and type of the new file, then rewrites the old URL in posts, all the metadata tables and the options table. In both cases WordPress regenerates the intermediate image sizes, and the plugin then clears the cache of the main caching plugins (including LiteSpeed Cache, WP Rocket and W3 Total Cache) as well as SiteGround and WP Engine caches.
The plugin is made by ShortPixel and is free, with no paid version. A beta feature, “Remove background”, sends an image to the ShortPixel API and returns a cut-out preview; it is free up to a quota, beyond which you need the API key of a ShortPixel Unlimited or Unlimited AI plan. Nothing loads on your public pages unless you use the file_modified shortcode, which prints a file’s modification date.
When Enable Media Replace saves you time
The plugin pays off whenever one file is used in several places or linked from outside your site:
- Documents you update often: a price list, catalog, spec sheet or PDF form keeps the same URL, including for the sites and emails that link to it.
- Documentation and help centers: a screenshot reused in ten articles is updated in one go.
- Logos, team photos and product shots changed after the fact, without reopening every page that shows them.
It is the wrong tool for rebuilding the thumbnails of a whole library after a theme change: Regenerate Thumbnails does that job.
Enable Media Replace strengths and limitations
Strengths
- Same item, same URL. In simple mode, the ID, URL and alt text stay put: there are no links to fix.
- Links updated across the database. The second mode rewrites the old URL, intermediate sizes included, in content, metadata and options.
- Automatic cache purge. The main caching plugins and two hosts are cleared after each replacement.
- Useful integrations. Dedicated code for Elementor, WPBakery, SiteOrigin, Breakdance and files offloaded by WP Offload Media.
- Free, no account. File replacement has no paid tier and no sign-up.
Limitations
- No undo. The screen says so: the replacement is permanent and the old file is not kept.
- CDNs and browsers are on you. A file that keeps its name can stay cached in the visitor’s browser or on a CDN the plugin does not purge.
- Renaming breaks outside links. Other sites, emails and social posts pointing to the old URL are not updated.
- Background removal happens off-site. Images go to ShortPixel’s servers, with a limited free quota.
- Four security releases in 2026. One fixed an unauthenticated PHP object injection, patched in 4.2.3.
The settings we recommend for Enable Media Replace
The plugin has no settings page: you pick the options on each replacement, on the screen opened from Media > Library > Replace media, and the plugin remembers your last choices. Two behaviors are controlled with PHP filters.
| Setting | Recommended value | Why |
|---|---|---|
| Just replace the file Replace media > Replacement Options | Your usual choice (default) | The URL does not change: nothing to rewrite in the database, no outside link broken. |
| Replace the file, use the new file name, and update all links Same screen | Only for a new name or a different format, after a database backup | It rewrites the old URL across the database, with no way back. |
| Keep the date Replace media > Options | Selected (default) | The item keeps its place in the library; pick “Replace the date with the current date” to flag a new version. |
| Place the newly uploaded file in this folder Replace media > Options | Unchecked | Moving the file changes its URL; keep the original folder unless you mean to reorganize. |
Filter emr/feature/backgroundChild theme functions.php or a code snippets plugin | __return_false if no image should leave your site | Removes background removal, which sends images to the ShortPixel API. |
Filter emr/feature/remote_noticeSame place | __return_false | Turns off the vendor’s remote notices shown in the dashboard. |
| Auto-updates Plugins > Installed Plugins | Enabled | The 2026 security fixes shipped in minor releases that are worth installing right away. |
- If a CDN serves your media, purge the file’s URL after each replacement.
- Before a replacement that renames the file, back up the database.
- Check under Plugins that the installed version is at least 4.2.3.
Enable Media Replace security: a run of fixes in 2026
The plugin writes files and rewrites the database, two sensitive operations. Most published vulnerabilities require an Author account, but some go further:
- CVE-2023-4643, fixed in 4.1.3: PHP object injection by an Author through the background removal feature.
- CVE-2026-114422, fixed in 4.2.3: the same class of flaw, reintroduced in 4.1.4. An unauthenticated visitor could plant a PHP object triggered during a replace-and-update-links operation, with a risk of code execution depending on the files present on the server.
- CVE-2026-2732, fixed in 4.1.8: an Author could replace any attachment with a background-removed version (CVSS 5.4).
- CVE-2026-85655, fixed in 4.2.3: through a replacement, an Author could modify published posts they are not allowed to edit (CVSS 4.3). Since that release, Authors only get the simple replacement.
What to do: turn on automatic plugin updates and limit file uploads to the accounts that need them, following the approach in our article on WordPress roles and capabilities. WP Masquerade Pro has nothing to remove for Enable Media Replace on your public pages (see the box below), so updating remains the real protection.
What WP Masquerade hides for Enable Media Replace
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Enable Media Replace: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
Nothing more
Still visible
No known trace
Enable Media Replace FAQ
Does Enable Media Replace update the links in my posts?
In “Just replace the file” mode the URL does not change, so there is nothing to update. In the renaming mode, the plugin rewrites the old URL throughout the database.
Why do I still see the old image after replacing it?
Usually it is a cache: the browser’s, a CDN’s or a tool the plugin does not purge. If the file really has not changed, the official FAQ suggests checking that WordPress can write to the uploads folder.
Can I replace a JPEG with a WebP or PNG?
Yes, with the mode that uses the new file name and updates all links. The simple mode expects a file of the same type and warns that another format can make the file unreadable.
Do I have to use background removal?
No, it is optional. It sends the image to ShortPixel and returns a transparent PNG if the source is a PNG, otherwise a white or custom-color background; the emr/feature/background filter turns it off completely.
Can an Author account replace files?
Yes, but since version 4.2.3 an Author only sees the simple replacement. Renaming, moving the file and removing the background are reserved for Editors and Administrators.