CVE-2026-94278: File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user who has file-upload privileges can exploit it. The affected attachment can belong to another user, including an administrator.
What access does an attacker need?
The attacker needs an account with permission to upload files. No administrator-level permission or ownership of the targeted attachment is required.
What is the likely impact of exploitation?
An attacker can rename media attachments owned by other users. Renaming can also corrupt unrelated site data that still references the attachment's previous file path.
Are attachments owned by administrators protected from lower-privileged upload users?
No. The issue allows users with file-upload privileges to rename attachments belonging to administrators because authorization to modify the specific attachment is not verified.