CVE-2026-94278

Published 6 October 2026 · tracked since 7 October 2026

Description

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-4889
• CVE-2026-41559 HIGH 7.5
• CVE-2026-39797 CRITICAL 9.8
• CVE-2026-39775 HIGH 8.8
• CVE-2026-39752 HIGH 7.7
• CVE-2026-39728 HIGH 7.2
• CVE-2026-32579 CRITICAL 10
• CVE-2026-105808 LOW 3.5
• CVE-2026-105809 MEDIUM 4.3
• CVE-2026-105059 MEDIUM 6.5

→ Open the live CVE board · all tools