File Media Renamer
Monthly
On any WordPress site running the File Media Renamer plugin through version 1.3, an authenticated low-privilege user who holds file-upload capability - typically an Author, or a Contributor explicitly granted uploads - can rename media attachments that belong to other users, including administrators, because the plugin never checks whether the requester is authorised to modify the targeted attachment. Beyond the direct rename, the operation rewrites the stored file path while leaving other site data (post content and plugin metadata that referenced the original path) pointing at the old filename, producing broken images and corrupted references that persist until manually repaired. Publicly available exploit code exists, and while there is no confirmed active exploitation (no CISA KEV entry), the flaw is trivially reachable by anyone who can already upload files, with no victim interaction required. Independent assessment characterises this as a broken-access-control / IDOR problem rather than an authentication bypass: the attacker must already hold a valid account, so it is an insider or multi-author-site threat, not a remote-unauthenticated one.
On any WordPress site running the File Media Renamer plugin through version 1.3, an authenticated low-privilege user who holds file-upload capability - typically an Author, or a Contributor explicitly granted uploads - can rename media attachments that belong to other users, including administrators, because the plugin never checks whether the requester is authorised to modify the targeted attachment. Beyond the direct rename, the operation rewrites the stored file path while leaving other site data (post content and plugin metadata that referenced the original path) pointing at the old filename, producing broken images and corrupted references that persist until manually repaired. Publicly available exploit code exists, and while there is no confirmed active exploitation (no CISA KEV entry), the flaw is trivially reachable by anyone who can already upload files, with no victim interaction required. Independent assessment characterises this as a broken-access-control / IDOR problem rather than an authentication bypass: the attacker must already hold a valid account, so it is an insider or multi-author-site threat, not a remote-unauthenticated one.