PT-2021-21381 · WordPress · Wordpress Media File Renamer – Auto & Manual Rename

Thiennv · Published 2021-10-04 · Updated 2021-10-08 · CVE-2021-36850

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WordPress Media File Renamer – Auto & Manual Rename plugin versions <= 5.1.9

Description A Cross-Site Request Forgery (CSRF) issue affects the plugin, allowing unauthorized changes to uploaded media. The affected parameters are post title, filename, and lock, which can be modified to change the media title, file name, and locking state.

Recommendations For WordPress Media File Renamer – Auto & Manual Rename plugin versions <= 5.1.9, update to a version higher than 5.1.9 to resolve the issue. As a temporary workaround, consider restricting access to the parameters post title, filename, and lock to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-36850

Affected Products

Wordpress Media File Renamer – Auto & Manual Rename

References · 5

• https://osv.dev/vulnerability/CVE-2021-36850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36850 · Security Note
• https://t.me/cibsecurity/29899 · Telegram Post
• https://wordpress.org/plugins/media-file-renamer/#developers · Note
• https://patchstack.com/database/vulnerability/media-file-renamer/wordpress-media-file-renamer-plugin-5-1-9-multiple-cross-site-request-forgery-csrf-vulnerabilities · Note