CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278

The File Media Renamer WordPress plugin (versions

PT-2026-68015

Name of the Vulnerable Software and Affected Versions User Access Manager versions prior to 2.3.13 Description Authenticated attackers with subscriber-level access and above can perform a Second-Order SQL Injection. This occurs via the 'id' parameter of the wp ajax save-attachment-compat AJAX...