CVE-2026-118043 in Bulk Media Register Plugin
Summary
by MITRE • 10/31/2026
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Bulk Media Register versions prior to 2.01 represents a critical failure in input validation regarding file system operations within the WordPress ecosystem. This flaw specifically affects how the plugin handles user-supplied paths when executing file move or rename commands on the server side. The core technical deficiency lies in the absence of rigorous sanitization and boundary checks for path parameters provided by authenticated users. Instead of restricting these operations to a predefined, safe directory structure associated with media uploads, the application accepts arbitrary path strings without verifying that they reside within expected boundaries. This lack of validation allows an attacker to manipulate the destination or source paths using relative navigation sequences such as dot-dot-slash characters. By exploiting this mechanism, it becomes possible to traverse outside the intended WordPress root directory and access locations on the server file system that are normally inaccessible through standard web application interfaces.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The operational impact is severe because it enables an attacker with even low-level privileges, such as the Author role in WordPress, to bypass directory-level access controls. Once arbitrary file movement or renaming capabilities are achieved, the immediate consequence is the potential disclosure of sensitive files stored outside the web root but still accessible via path traversal techniques if combined with other vulnerabilities like local file inclusion. Furthermore, an attacker could potentially overwrite critical configuration files or scripts within the WordPress installation by moving malicious content into executable directories, thereby facilitating remote code execution. This undermines the integrity and confidentiality guarantees provided by the hosting environment's default security posture.
The exploitation of this flaw aligns closely with ATT&CK technique T1083: File and Directory Discovery, as it allows for reconnaissance of the server file system structure beyond public-facing assets. Additionally, if used to overwrite files, it relates to T1564: Host File System Indicator Removal or Tampering, although in this specific context, the primary risk is unauthorized access and data exfiltration through path manipulation rather than direct execution. The severity is amplified by the fact that WordPress Author accounts are relatively common and often granted more trust than anonymous visitors but less than administrators, making them a frequent target for privilege escalation attacks via plugin vulnerabilities.
To mitigate this vulnerability, immediate action must be taken to update the Bulk Media Register plugin to version 2.01 or later where these input validation checks have been implemented correctly. Administrators should ensure that all plugins are kept up-to-date with their latest security patches provided by vendors. In environments where updating is not immediately feasible, implementing strict file upload and manipulation restrictions at the web server level can provide a layer of defense in depth. This includes configuring PHP settings to disable dangerous functions like move_uploaded_file if they are misused, or using open_basedir directives to restrict PHP script access to specific directories. Regular auditing of plugin code for proper path canonicalization is also recommended to prevent similar issues across the WordPress ecosystem.