Bulk Media Register Path Traversal Vulnerability

Executive Summary

CVE-2026-118043 is a path traversal vulnerability in the Bulk Media Register WordPress plugin versions below 2.01. It allows users with the Author role to move or rename arbitrary files on the server, including files outside the WordPress root directory, due to improper validation of user-supplied paths.

Useful 0 Not Useful 0

Detection Guidance

Check if the Bulk Media Register WordPress plugin version is below 2.01. Inspect server logs for unusual file movement or renaming actions by Author role users. Look for path traversal patterns in requests targeting the plugin.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with Author role privileges to bypass directory-level access controls, move or rename files, and potentially disclose protected files. It may lead to unauthorized file access, data leaks, or system compromise.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Bulk Media Register WordPress plugin to version 2.01 or later immediately. Remove or restrict Author role permissions if file manipulation is not required. Monitor server logs for suspicious activity related to file operations.

Useful 0 Not Useful 0