CVE-2026-118043

The Bulk Media Register WordPress plugin (versions before 2.01 ) contains a vulnerability where it fails to properly validate user-supplied paths during file move operations. This allows users with the Author role to move or rename arbitrary files on the server. Attackers can exploit this to bypa...