title: Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming
description: The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own.
problem types: CWE-284 Improper Access Control
affected:
{
product: Phoenix Media Rename
vendor: Unknown
versions:
lessThan: 3.4.4, status: affected, version: 3.4.4, versionType: custom
}