UNKNOWN NVD

CVE-2026-118043

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

References

https://wpscan.com/vulnerability/bcb6cb6b-d1bc-4c92-8c3b-4ad48348a2b1/

Published: 2026-10-31 · Source: NVD · Feed updated: 2026-10-31

This unknown severity vulnerability was published on 2026-10-31 via NVD.

vulnfeed aggregates 18441 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.