CVE-2023-50897 - CVE House

Status published Critical CVE-2023-50897

WordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerability

9.1 CVSS

Vulnerability Description

Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Renamer: from n/a through 5.7.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-50897

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Taihei Shimamine | Patchstack Bug Bounty Program

References

https://vdp.patchstack.com/database/wordpress/plugin/media-file-renamer/vulnerability/wordpress-media-file-renamer-plugin-5-7-7-arbitrary-file-rename-lead-to-rce-vulnerability?_s_id=cve

More from Meow Apps

View All →

CVE-2021-36850

WordPress Media File Renamer – Auto & Manual Rename plugin <= 5.1.9 - Cross-Site Request Forgery (CSRF) vulnerability

Medium 5.4

Affected Vendor

Meow Apps

View all reports →

Affected Software

Media File Renamer

Vulnerable Versions:

Unknown

Timeline

Official Publish: January 5th, 2026

Last Modified: April 28th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1505.003 Web Shell

Persistence

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

Execution

T1565.002 Stored Data Manipulation

Impact