CVE-2026-118043 Bulk Media Register CVE debrief

Who should care

Defenders responsible for WordPress installations, particularly those with Author role users, should assess exposure and prioritize verification and remediation efforts. This includes reviewing the presence of the Bulk Media Register WordPress plugin version before 2.01, restricting access to Author role users if necessary, and implementing additional monitoring and logging to detect potential file movement or renaming attempts. Security teams and platform

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure to Author role users, as it can lead to potential disclosure of protected files and defeat directory-level access controls.

• Potential disclosure of protected files due to inadequate path validation.
• Defeat of directory-level access controls by moving or renaming arbitrary files.
• Verification priority for WordPress installations with Author role users.

Technical summary

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root. This vulnerability can be exploited to defeat directory-level access controls and disclose protected files. The plugin's lack of proper path validation enables attackers to manipulate file locations, potentially leading to unauthorized access to sensitive information. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure to Author role users.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure to Author role users.

Recommended defensive actions

• Verify the presence of the Bulk Media Register WordPress plugin version before 2.01 in your WordPress installations.
• Assess exposure to Author role users and restrict access if necessary.
• Consider implementing additional monitoring and logging to detect potential file movement or renaming attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional verification is needed to confirm affected versions and remediation. The Bulk Media Register WordPress plugin before 2.01 is vulnerable, and defenders should verify the presence of this plugin in their WordPress installations. The vulnerability allows users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files. The source details are from

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.