Relocate Upload

Relocate Upload has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2011 and 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. Relocate Upload is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.3.23.

Strategic Overview

Avg CVSSHigh

7.1/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all Relocate Upload vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-53315

Relocate Upload <= 0.24.1 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

2 records


2025-06-27 00:00	Relocate Upload <= 0.24.1 - Cross-Site Request Forgery Relocate Upload <= 0.24.1	`CVE-2025-53315`	4.3 Medium	Skalucy	No
2011-09-19 00:00	Relocate Upload < 0.20 - Remote File Inclusion Relocate Upload < 0.20	`CVE-2012-1205`	9.8 Critical	Ben Schmidt	Yes

Showing 1–2 of 2 reports

Plugin Profile

Latestv0.24.1

Relocate Upload

Author

alanft

3.4(7)

68/100

Last Updated

2020-02-08 (7y ago)

Active Installs

100+

Downloads

15,278

Requires WP

2.8+

Requires PHP

Tested up to

WP 5.3.23

Created

2008-10-24 (18y ago)

Relocate Upload lets you specify folders, and adds a menu to the Media Library (and Edit Media admin page) that lets you switch media items between these folders and WPs default upload location. Known Issues When creating new folders,

View on WordPress.org