Live › vulnerability › CVE-2026-118043
The Bulk Media Register WordPress plugin before 2.01 does not validate a user-supplied path before moving a file on the server. An authenticated user with the Author role can move or rename arbitrary files, including outside the WordPress root, which can expose protected files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Bulk Media Register WordPress plugin before 2.01 that have users with the Author role. An attacker needs an Author account, so sites with no Author users or with only trusted authors face less risk. Sites not running this plugin are not affected.
No product ranges from the sources yet.
2.01 are affected.2.01 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.
This page as .md · .json · in your agent: get_signal("CVE-2026-118043")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.