7.2Hoch

CVE-2026-118043Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal

Bulk Media Register Veröffentlicht: 2026-10-31 09:00 (vor 3 Tagen)

Beschreibung

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.

Schwachstellentyp (CWE): CWE-22

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
—	Bulk Media Register	< 2.01

Referenzen und Patches

https://wpscan.com/vulnerability/bcb6cb6b-d1bc-4c92-8c3b-4ad48348a2b1/ exploitvdb-entrytechnical-description

CVSS-Score

7.2Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Hoch
Rechte erforderlich: Hoch
Benutzerinteraktion: Keine
Geltungsbereich: Geändert
Vertraulichkeit: Hoch
Integrität: Niedrig
Verfügbarkeit: Niedrig

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Alle Scores (2)

CISA-ADP	CVSS 3.1	7.2Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.2Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.24%

höher als 15 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-10-27
Veröffentlicht2026-10-31 09:00
Bei IP-DB eingegangen2026-10-31 09:03
Zuletzt aktualisiert2026-11-02 19:20

Vergeben von (CNA): WPScan
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

5.3Mittel

CVE-2026-119509 vor 5 Stunden

WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability

eranfl ClickCease Click Fraud Protection

Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.

4.3Mittel

CVE-2026-97072 vor 5 Stunden

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

myCred myCred

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

5.3Mittel

CVE-2026-114187 vor 5 Stunden

WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability

WPVibes AnyWhere Elementor

Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

4.3Mittel

CVE-2026-103077 vor 6 Stunden

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

myCred myCred

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

6.5Mittel

CVE-2026-114185 vor 6 Stunden

WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

WPVibes AnyWhere Elementor

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

5.3Mittel

CVE-2026-119485 vor 6 Stunden

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

weDevs Dokan

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.