CVE-2026-94278

File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.

Affected

File Media Renamer

CVSS v3.1 CNA

5.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

EPSS

0.21% chance of exploitation in the next 30 days, 11th percentile

Published

2026-10-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4967e8c2-ee27-4d26-955c-f7dfb6cd6942/

References

• CVE Record
• NVD entry