CVE-2026-94278: 
WordPress vulnerability analysis and mitigation

CVE-2026-94278 is an improper access control vulnerability in the File Media Renamer WordPress plugin (versions through 1.3) that allows any authenticated user with file-upload privileges (Author role or higher) to rename media attachments belonging to other users, including administrators, and corrupt stored site data referencing the old file paths. The vulnerability was discovered by Sebastian Riveros, added to WPScan on 2026-09-26, and publicly published on 2026-10-03. There is currently no known fix available. It carries a CVSS v3.1 base score of 5.5 (Medium) per Feedly threat intelligence data, though WPScan rates it 6.5 (Medium) (WPScan).

The root cause is CWE-284 (Improper Access Control), classified under OWASP Top 10 A5: Broken Access Control. The plugin's save-attachment-compat endpoint fails to verify that the requesting user is authorized to modify a specific media attachment before processing rename operations, meaning any user with file-upload privileges can target attachments owned by other users, including administrators. This is a network-accessible vulnerability requiring no user interaction, exploitable by any authenticated user with at minimum Author-level privileges. A proof-of-concept is scheduled for public release on October 17, 2026, to allow time for users to update (WPScan).

Successful exploitation allows an attacker to rename media attachments owned by any user on the WordPress site, including administrators, leading to high integrity impact. Additionally, renaming files corrupts stored site data (e.g., database records, post content, widget configurations) that reference the old file path, causing broken media links and partial availability disruption. There is no confidentiality impact, as the vulnerability does not expose file contents, but the integrity and availability consequences can disrupt site functionality and deface content (WPScan).

No active in-the-wild exploitation has been reported, and no exploit code is currently publicly available; the PoC is scheduled for release on October 17, 2026. The CVE status is listed as "Deferred" and NVD's SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.0013 (0.13%), reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan).

1. Reconnaissance: Identify WordPress sites running the File Media Renamer plugin version 1.3 or earlier. This can be done by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/file-media-renamer/readme.txt or using tools like WPScan.
2. Obtain Author-level access: Register or compromise an account with at minimum Author (file-upload) privileges on the target WordPress site.
3. Identify target attachment IDs: Browse the WordPress media library or enumerate attachment IDs via the WordPress REST API (/wp-json/wp/v2/media) to find attachments owned by other users, including administrators.
4. Send unauthorized rename request: Submit a crafted POST request to the plugin's save-attachment-compat endpoint, specifying a target attachment ID belonging to another user and a new filename, without any authorization check being enforced by the plugin.
5. Achieve impact: The attachment is renamed on the server, breaking any existing references to the old file path in posts, pages, or widgets, and potentially disrupting site content or enabling further manipulation of media assets (WPScan).

• Logs: WordPress access logs showing POST requests to the save-attachment-compat endpoint from users who do not own the targeted attachment IDs; repeated rename operations across multiple attachment IDs from a single low-privileged account.
• File System: Media files in wp-content/uploads/ with unexpected name changes, particularly for files owned by administrator accounts; broken image or file references in posts and pages.
• Database: WordPress wp_posts and wp_postmeta tables showing guid or _wp_attached_file values that no longer match existing files on disk; post content containing broken media URLs.

There is currently no known fix or patched version available for the File Media Renamer plugin (through version 1.3). The recommended immediate action is to deactivate and remove the plugin from WordPress installations until a patched version is released. Site administrators should also audit their media library for unauthorized renames and restrict Author-level account creation to trusted users only (WPScan).

A Reddit thread in r/StopBadBots referenced this CVE in the context of a broader discussion about unpatched WordPress plugins, suggesting community awareness of the issue. No significant vendor statements, notable researcher commentary beyond the original discoverer (Sebastian Riveros), or major media coverage has been identified at this time (Reddit).