CVE-2026-118043highCWE-22

CVE-2026-118043: high-severity vulnerability in Bulk Media Register

Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal

Published · Updated

Follow this CVE+ Monitor Bulk Media Register

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.2epss 0.2%
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Affected products
Unknown · Bulk Media Register
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.