Bulk Media Register CVE-2026-118043

Requires an authenticated WordPress account with at least the Author role on a site running Bulk Media Register before 2.01; the attacker must be able to invoke the plugin's file move/rename feature with an attacker-controlled path. What LIMITS exploitation: it is not unauthenticated - the actor needs a valid Author-level (or higher) account, so sites that do not provision Author accounts to untrusted users are not practically exposed; the CVSS vector also marks AC:H, implying a non-trivial trigger, though the sources do not state what the added complexity is. Impact is bounded to moving/renaming files and disclosing protected file contents (CWE-22) rather than direct code execution.

This is a moderate-priority issue whose signals mostly agree that it is real but not urgent for most environments. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C) scores 7.2 (High) and requires an authenticated actor - PR:H in the vector, though the description attributes the capability to the WordPress Author role, which is a low-privilege authenticated role and would normally map to PR:L; this PR:H-vs-Author-role discrepancy should be verified and likely understates reachability. EPSS is low at 0.16% (5th percentile), the CVE is NOT in CISA KEV, and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - a consistent picture of no observed exploitation and no mass-automation path. The input provides no confirmed working exploit code, only the WPScan advisory reference, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_week,' which is the main reason this rises above routine patching: it reflects a confirmed-fix, authenticated path-traversal with a scope change that can disclose protected files outside the WordPress root. Net: a genuine but gated vulnerability - real priority on sites that hand out Author accounts (multi-author blogs, membership sites), low priority on single-admin installations.

An attacker who holds (or phishes/registers into) a WordPress Author account on a site running Bulk Media Register before 2.01 supplies a crafted file path to the plugin's move/rename function, directing it outside the WordPress root to relocate or rename a protected file and defeat directory-level access controls, disclosing its contents. No public working exploit code is identified at time of analysis; the trigger mechanism beyond 'user-supplied path not properly validated' is not detailed in the available sources. The CVSS vector marks attack complexity High (AC:H), but the sources do not describe what makes the trigger complex.