CVE-2026-17541: Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17541?
CVE-2026-17541 has a risk score of 36, indicating a moderate severity level.
How do I fix CVE-2026-17541?
To fix CVE-2026-17541, update the File Manager plugin to version 6.9.1 or later.
What does CVE-2026-17541 affect?
CVE-2026-17541 affects the File Manager WordPress plugin versions prior to 6.9.1.
What kind of information can be exposed due to CVE-2026-17541?
CVE-2026-17541 allows unauthenticated users to view the file activity log, revealing file operations, involved paths, and user names.
Is the exploitation of CVE-2026-17541 dangerous?
Yes, the exploitation of CVE-2026-17541 could lead to unauthorized access to sensitive file activity information.