/Vulnerability Library

WordPress Bit File Manager < 6.9.1 - Arbitrary File Read

CVE-2026-17540
Early Release

Description

The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory.

Severity

High

CVSS Score

8.8

Affected Product

file-manager

Published Date

October 26, 2026

Template Author

anirbala98

CVE-2026-17540.yaml
8.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-17540
CWE ID:
cwe-284

References

https://wpscan.com/vulnerability/096cb7df-26a5-4f5f-bbec-725e063a2b75/https://nvd.nist.gov/vuln/detail/CVE-2026-17540https://wordpress.org/plugins/file-manager/

Remediation Steps

Update to version 6.9.1 or later.