Unauthorized Access in File Media Renamer Plugin for WordPress
CVE-2026-94278
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-94278?
The File Media Renamer plugin for WordPress has a flaw that fails to validate user authorization for modifying media attachments. This vulnerability allows any user with file-upload privileges to rename media files belonging to other users, including site administrators. As a result, it can lead to potential disruption or corruption of site data that relies on the previous file paths, posing a significant security risk for website integrity.
Affected Version(s)
File Media Renamer 0 <= 1.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.