CVEs-PoC/2021/CVE-2021-24816.md

CVE-2021-24816

Description

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own.

POC

Reference

• https://wpscan.com/vulnerability/5f63d677-20f3-4fe0-bb90-048b6898e6cd
• https://wpscan.com/vulnerability/5f63d677-20f3-4fe0-bb90-048b6898e6cd

Github

No PoCs found on GitHub currently.