CVE-2021-24816

Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own.

Affected

Phoenix Media Rename

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

0.68% chance of exploitation in the next 30 days, 51st percentile

Published

2021-11-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5f63d677-20f3-4fe0-bb90-048b6898e6cd

References

• CVE Record
• NVD entry