CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected parameters "post_title", "filename", "lock". This allows changing the uploaded media title, media file name, and media locking state.
Explanation of Vulnerability in Simple Terms
The Media File Renamer plugin for WordPress versions up to 5.1.9 lacks CSRF protection on its file renaming functionality. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, triggers unauthorized file rename operations without the admin's knowledge or consent. This can corrupt media library organization or cause site functionality issues.
What an attacker can do
Rename media files on the site without the admin's permission by tricking them into visiting a malicious page.
Potential impact on your site
Media files can be renamed or reorganized without your knowledge, potentially breaking image links or disrupting site functionality.
Conditions required to exploit
A logged-in WordPress administrator must visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
