CVE-2023-32095 CRITICAL

CVE-2023-32095: WordPress Rename Media Files Plugin <= 1.0.1 is vulnerable to Remote Code Execution (RCE)

Vendor Milan Dinić
Product Rename Media Files
Weakness CWE-94 · Code injection
Published December 29, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Milan Dinić Rename Media Files.This issue affects Rename Media Files: from n/a through 1.0.1.

Explanation of Vulnerability in Simple Terms

02Summary

Rename Media Files allows authenticated users to inject and execute arbitrary PHP code on the site. An attacker with low-level access can run their own code through unsanitized input, compromising the entire site. The vulnerability affects all versions up to 1.0.1 and requires only network access and a valid user account.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site with full system privileges.

Potential impact on your site

04Site Impact

Complete site compromise: data theft, malware injection, defacement, or total takeover possible.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level permissions (e.g., contributor or subscriber).

Key dates

06Disclosure timeline

December 29, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57624 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability CVE-2026-39465 WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability CVE-2017-20251 WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API CVE-2026-3309 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields CVE-2026-3584 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process