Public vulnerability disclosure

CVE-2026-118043

publishedCWE-22

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

Investigate in Cyber JSON Markdown

Technical severity7.2 highCVSS 3.1 · NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Published2026-10-31Source updated 2026-11-01

Collected2026-11-021 attributed source

Fixes and workarounds

No remediation reported in collected sources.

Missing remediation information is not evidence that no patch exists.

Affected products and versions

No affected-product ranges reported in collected sources.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 7.2 high	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L`	NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://wpscan.com/vulnerability/bcb6cb6b-d1bc-4c92-8c3b-4ad48348a2b1/[email protected]