The File Media Renamer WordPress plugin up to version 1.3 does not verify that the user requesting a change to a media attachment is authorized, allowing any user who can upload files to rename attachments owned by other users, including administrators. This capability can break links or references to the file stored elsewhere in the site, leading to data corruption or loss of functionality.

WordPress sites that have installed File Media Renamer plugin version 1.3 or earlier are affected. Any user with the ability to upload files—regardless of role—can exploit the flaw, so sites with permissive file‑upload permissions are directly impacted.

Exploitation requires only the normal file‑upload privilege to trigger the plugin’s rename function. The CVSS v3 score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack path is straightforward: an attacker uses the plugin’s rename operation with crafted parameters to rename any attachment on the site.