Bit File Manager < 6.9.1 Authenticated Arbitrary File Read/Deletion via Broken Access Control (CVE-2026-17540)

Vulnerability Overview Vulnerability Name: Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch Description: The plugin fails to properly authorize its file management commands, allowing any authenticated user (such as a subscriber) to read and delete arbitrary files within the WordPress installation directory. This could lead to the leakage of website configuration secrets and service denial. CVE Number: CVE-2026-17540 Classification: - Type: ACCESS CONTROLS - OWASP Top 10: A5: Broken Access Control - CWE: CWE-284 - CVSS: 8.8 (High) Affected Scope Affected Plugin: file-manager Fixed Version: 6.9.1 Remediation Fixed Version: Upgrade to version 6.9.1 or higher. Timeline Public Disclosure Date: 2026-08-04 Addition Date: 2026-08-04 Last Updated: 2026-08-07 Additional Information Original Researcher: Artus KG Submitter: Artus KG Submitter Twitter: artuskg Verification Status: Yes WPVDB ID: 096cb7df-26a5-4f5f-bbec-725e003a2b75 POC Code References CVE: CVE-2026-17540 Other Related Vulnerabilities B Slider - Gutenberg Slider Block for WP < 1.1.24 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider-shortcode WP LMS < 1.1.5 - Unauthenticated Arbitrary User Field Edition/Creation Frontend File Manager < 18.3 - Unauthenticated Arbitrary Post Deletion WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers Download Manager < 3.2.85 - Unauthenticated File Download Summary This vulnerability involves an access control issue in the Bit File Manager plugin, allowing low-privilege users to perform sensitive operations. It is recommended to upgrade to the fixed version 6.9.1 as soon as possible to address this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Bit File Manager < 6.9.1 Authenticated Arbitrary File Read/Deletion via Broken Access Control (CVE-2026-17540)

More from this source