{"id":"CVE-2026-118043","kind":"vulnerability","aliases":["CVE-2026-118043"],"related":[],"title":"WordPress Bulk Media Register: Author users can move arbitrary server files","description":"The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.","summary":"The Bulk Media Register WordPress plugin before 2.01 does not validate a user-supplied path before moving a file on the server. An authenticated user with the Author role can move or rename arbitrary files, including outside the WordPress root, which can expose protected files.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bulk-media-register","package","wordpress"],"not_affected_if":["no-author-users","plugin-2.01-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Bulk Media Register plugin in the WordPress admin under Plugins; versions before `2.01` are affected.\n- Review which accounts hold the Author role, since those are the accounts that can trigger it.","fix":"- Update the Bulk Media Register plugin to `2.01` or later.","status":"open","published_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:32+00:00","updated_at":"2026-10-31T06:34:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T06:34:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Bulk Media Register plugin to `2.01` or later.","reach":"network","title":"WordPress Bulk Media Register: Author users can move arbitrary server files","impact":"medium","summary":"The Bulk Media Register WordPress plugin before 2.01 does not validate a user-supplied path before moving a file on the server. An authenticated user with the Author role can move or rename arbitrary files, including outside the WordPress root, which can expose protected files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bulk-media-register"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated Author moves server files, exposing protected data outside web root","analyst_note":"","how_to_check":"- Check the installed version of the Bulk Media Register plugin in the WordPress admin under Plugins; versions before `2.01` are affected.\n- Review which accounts hold the Author role, since those are the accounts that can trigger it.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-2.01-or-later","no-author-users"],"who_is_affected":"Sites running the Bulk Media Register WordPress plugin before 2.01 that have users with the Author role. An attacker needs an Author account, so sites with no Author users or with only trusted authors face less risk. Sites not running this plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4115,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118043':14A,17A '-2026':13A,16A '2.01':31B,77C 'access':117C 'allow':94C 'arbitrari':9A,58B,104C 'authent':48B 'author':5A,52B,98C 'bulk':2A,19B,25B,71C 'bulk-media-regist':18B 'control':118C 'cve':12A,15A 'defeat':113C 'directori':115C 'directory-level':114C 'disclos':120C 'expos':67B 'file':11A,43B,59B,69B,90C,105C,122C 'includ':60B,106C 'level':116C 'media':3A,20B,26B,72C 'move':8A,41B,55B,88C,101C 'outsid':61B,107C 'packag':22B 'path':39B,86C 'plugin':29B,75C 'proper':80C 'protect':68B,121C 'regist':4A,21B,27B,73C 'renam':57B,103C 'role':53B,99C 'root':64B,110C 'server':10A,46B,93C 'suppli':38B,85C 'user':6A,37B,49B,84C,95C 'user-suppli':36B,83C 'valid':34B,81C 'wordpress':1A,23B,28B,63B,74C,109C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Bulk Media Register WordPress plugin before 2.01 that have users with the Author role. An attacker needs an Author account, so sites with no Author users or with only trusted authors face less risk. Sites not running this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118043","severity":null,"published_at":"2026-10-31T06:16:33+00:00","modified_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}