Threats tagged 'ghsa-fxjq-44vq-hwjg'

The Bulk Media Register WordPress plugin versions before 2.01 contain a vulnerability where user-supplied file paths are not properly validated before moving files on the server. This flaw allows users with the Author role to move or rename arbitrary files, potentially outside the WordPress root directory, which can bypass directory-level access controls and expose protected files.