CVE-2026-17542: Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bit File Managerto a version that resolves this vulnerability.Fixed in 6.9.1 - Compensating control
Ensure only users with appropriate WordPress capabilities can access the Bit File Manager file manager connector endpoint that lacks capability checks, preventing subscribers from browsing the WordPress installation directory and downloading archive/document file types.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17542?
CVE-2026-17542 has a risk score of 52, indicating a moderate severity level.
How do I fix CVE-2026-17542?
To fix CVE-2026-17542, update the File Manager plugin to version 6.9.1 or later.
What does CVE-2026-17542 exploit in the File Manager plugin?
CVE-2026-17542 exploits a lack of capability checks on a file manager connector endpoint, allowing unauthorized file access.
Who is affected by CVE-2026-17542?
Any authenticated user, including subscribers, can be affected by CVE-2026-17542.
What type of data is exposed in CVE-2026-17542?
CVE-2026-17542 allows unauthorized access to sensitive data files within the entire WordPress installation directory.