CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
An attacker with upload privileges can rename other users' media attachments, corrupting site data due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94278?
CVE-2026-94278 is a medium-severity missing authorization vulnerability in Unknown File Media Renamer, published on 6 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
Weakness: CWE-284
Which versions are affected by CVE-2026-94278?
How do I fix CVE-2026-94278?
No fix has been published for CVE-2026-94278 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-94278 being exploited?
There is no known exploitation of CVE-2026-94278 in the wild and no public exploit code.
Sources
Also known as GHSA-rfmq-49f4-7xx9.