CVE-2023-44991: 
WordPress vulnerability analysis and mitigation

The Media File Renamer: Rename Files (Manual, Auto & AI) WordPress plugin was found to contain a Sensitive Information Exposure vulnerability (CVE-2023-44991). The vulnerability affects all versions up to and including 5.6.9, and was discovered by Joshua Chan. The issue was publicly disclosed on November 28, 2023 (WPScan, Patchstack).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It received varying CVSS scores: NIST assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Patchstack rated it at 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows unauthenticated attackers to extract sensitive data, including file upload events and paths, through the plugin's logging functionality (WPScan).

The vulnerability can be exploited by unauthenticated users, requiring no special privileges or user interaction according to the NIST assessment (NVD).

The vulnerability has been fixed in version 5.7.0 of the Media File Renamer plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).