PT-2026-1280 · Unknown · Media File Renamer

Published 2026-01-05 · Updated 2026-01-05 · CVE-2023-50897

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Media File Renamer versions through 5.7.7

Description The software contains a flaw related to unrestricted file uploads, allowing the use of malicious files. This can lead to potential cyber security risks. The issue involves the ability to rename uploaded PHP files, potentially bypassing security measures and creating a remote code execution (RCE) kill chain.

Recommendations Versions prior to 5.7.7 should be updated.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-50897

Affected Products

Media File Renamer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-50897 · Security Note
• https://twitter.com/CveFindCom/status/2008186511955534150 · Twitter Post
• https://vdp.patchstack.com/database/wordpress/plugin/media-file-renamer/vulnerability/wordpress-media-file-renamer-plugin-5-7-7-arbitrary-file-rename-lead-to-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/0dayPublishing/status/2008171848161177720 · Twitter Post