CVE-2026-17540: Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress File Manager pluginto a version that resolves this vulnerability.Fixed in 6.9.1 - Compensating control
Restrict access so that non-privileged WordPress roles (e.g., subscribers) cannot use the File Manager connector/command endpoints until the plugin is upgraded to 6.9.1.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17540?
The severity of CVE-2026-17540 is rated at 65, indicating a moderate risk level.
How do I fix CVE-2026-17540?
To fix CVE-2026-17540, update the Bit File Manager plugin to version 6.9.1 or later.
What type of vulnerability is CVE-2026-17540?
CVE-2026-17540 is an arbitrary file read and deletion vulnerability affecting the Bit File Manager plugin for WordPress.
Who is affected by CVE-2026-17540?
Any authenticated user, including subscribers, is affected by CVE-2026-17540.
What could happen if CVE-2026-17540 is exploited?
Exploitation of CVE-2026-17540 could lead to unauthorized access to sensitive files and potential site configuration disclosure.