EUVD-2026-92968
GHSA-rfmq-49f4-7xx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with file-upload privileges
-
DeliverySubmit crafted media rename request
-
ExploitBypass missing ownership/authorization check
-
ExecutionRename another user's attachment
-
ImpactCorrupt stored data referencing old path
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account that holds file-upload capability (typically the Author role, or a Contributor explicitly granted uploads) on a site running File Media Renamer ≤1.3; no special plugin configuration or non-default mode is needed, and no victim interaction is required. The limiting factor is that the attacker must already have a valid low-privilege account on the target site - this is an insider/multi-author-site threat, not remote-unauthenticated. Exploitation is only meaningful where other users (e.g., administrators) own media attachments worth renaming/corrupting. |
| Impact | This is a broken-access-control (CWE-284, missing authorization) flaw in the File Media Renamer WordPress plugin through 1.3, best characterized as an authorization/IDOR issue rather than an authentication bypass. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L, base 5.5) indicates network-reachable, low-complexity exploitation with high integrity impact but no confidentiality impact. Note a conflict: the vector uses PR:H, yet the description says exploitation only requires 'any user with file-upload privileges' - in WordPress that corresponds to the Author role (or a Contributor granted upload), which is a low, not high, privilege; PR:L is the more defensible choice and would raise the real score to roughly 6.5. POC code is publicly available (WPScan), which increases practical exploitability, but there is no CISA KEV listing and no EPSS value in the input, so there is no evidence of active or widespread exploitation - treat it as proof-of-concept rather than confirmed in-the-wild abuse. Net: a genuine but moderate, authenticated-insider risk on multi-author sites, not an unauthenticated internet-facing critical. |
| Exploit ScenarioDerived | On a multi-author WordPress site, a low-privileged user who only has media-upload rights sends a crafted rename request targeting a media attachment owned by another user, including an administrator. Because the plugin never checks attachment ownership or capability, the rename succeeds and can simultaneously corrupt unrelated stored site data that referenced the old file path. Public POC code from WPScan lowers the skill barrier for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
On any WordPress site running the File Media Renamer plugin through version 1.3, an authenticated low-privilege user who holds file-upload capability - typically an Author, or a Contributor explicitly granted uploads - can rename media attachments that belong to other users, including administrators, because the plugin never checks whether the requester is authorised to modify the targeted attachment. Beyond the direct rename, the operation rewrites the stored file path while leaving other site data (post content and plugin metadata that referenced the original path) pointing at the old filename, producing broken images and corrupted references that persist until manually repaired. Publicly available exploit code exists, and while there is no confirmed active exploitation (no CISA KEV entry), the flaw is trivially reachable by anyone who can already upload files, with no victim interaction required. Independent assessment characterises this as a broken-access-control / IDOR problem rather than an authentication bypass: the attacker must already hold a valid account, so it is an insider or multi-author-site threat, not a remote-unauthenticated one.
RemediationAI
No vendor-released patch is identified in the available intelligence - the supplied references contain only the WPScan advisory (tagged as exploit) and an NVD mirror, and no fixed plugin version is named, so do not assume an update alone will resolve the issue. The most reliable immediate action is to deactivate and delete the File Media Renamer plugin if its rename function is not actively required; the trade-off is loss of the functionality, which for most sites is cosmetic and acceptable. If the plugin must remain, remove the 'upload_files' capability from untrusted roles - on a default WordPress install this means the Author role, and any Contributor that has been granted uploads - using a role-management plugin or a small filter on the 'user_has_cap' hook; the trade-off is that those users can no longer upload media at all, which breaks legitimate editorial workflows, so restrict this to roles that do not genuinely need it. Complement this by auditing who holds 'upload_files' and 'edit_posts' and by treating multi-author sites as the primary exposure surface, since the flaw requires only an existing low-privilege account. Take a database and uploads-directory backup before any remediation so that attachments whose '_wp_attached_file' metadata or in-content paths have already been desynchronised can be enumerated and repaired; a simple integrity scan comparing attachment metadata against files actually present in wp-content/uploads will reveal prior exploitation. Monitor the WPScan advisory and the NVD/EUVD entries for a patched release, and re-enable the plugin only once a version that enforces per-attachment 'edit_post' authorisation is published and independently confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing-authorization defect (CWE-284) in a WordPress plugin whose purpose is to rename media files. In WordPress, every uploaded file is a post of type 'attachment' with an accompanying '_wp_attached_file' postmeta entry; that stored path is then referenced by the attachment guid, by post content that embeds the file, and by other plugins and themes. A safe rename therefore requires both a capability check on the specific attachment (WordPress's edit_post meta-capability, which maps attachment ownership to the uploader) and a coordinated update of every reference to the old path. File Media Renamer 1.3 through version 1.3 performs the rename without verifying that the requesting user is authorised for the given attachment, so a user with the upload_files capability can submit an arbitrary attachment identifier and have the plugin rename someone else's file. The CPE record (cpe:2.3:a:unknown:file_media_renamer:*:*:*:*:*:*:*:*) confirms the plugin as the affected component but leaves the vendor string unrecorded, a known data-quality gap in this entry. The impact is integrity-oriented rather than confidentiality-oriented: files and the data referencing them can be renamed and desynchronised, but no information is disclosed to the attacker (C:N in the assessed vector), and the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L reflects that a low-privilege authenticated actor is sufficient and that no user interaction or non-default plugin configuration is needed.
Know when File Media Renamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
File-upload privilege equals Author-level access, so PR:L (not PR:H); unauthorized renames give I:H, incidental data corruption gives A:L, and no data is disclosed so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB