Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming
CVE-2021-24816

4.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Phoenix Media Rename
Vendor
CVE Published:
8 November 2021

What is CVE-2021-24816?

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own.

Affected Version(s)

Phoenix Media Rename 3.4.4

References

https://wpscan.com/vulnerability/5f63d677-20f3-4fe0-bb90-...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

apple502j
.