WordPress Media File Renamer – Auto & Manual Rename plugin <= 5.1.9 - Cross-Site Request Forgery (CSRF) vulnerability
CVE-2021-36850

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Media File Renamer – Auto & Manual Rename (WordPress Plugin)
Vendor
CVE Published:
4 October 2021

What is CVE-2021-36850?

Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected parameters "post_title", "filename", "lock". This allows changing the uploaded media title, media file name, and media locking state.

Affected Version(s)

Media File Renamer – Auto & Manual Rename (WordPress plugin) <= 5.1.9 <= 5.1.9

References

https://wordpress.org/plugins/media-file-renamer/#developers
x_refsource_CONFIRM
https://patchstack.com/database/vulnerability/media-file-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Original researcher - Ngo Van Thien (Patchstack Red Team)
.