Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: File Manager 6.9.1 Clear all filters
TI-2026-14388 CVE-2026-17541

Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

Priority HIGH 72

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00434 Published 2026-08-10 Fixed in 6.9.1 CWE-200
TI-2026-14387 CVE-2026-17540 · GHSA-mr78-php7-96p9

Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

Priority MEDIUM 44

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress insta…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01827 Published 2026-08-10 Fixed in 6.9.1 CWE-284