vulnerability

WordPress Plugin: file-manager: CVE-2024-7627: Improper Control of Generation of Code ('Code Injection')

Severity
8
CVSS
(AV:N/AC:H/Au:N/C:C/I:C/A:C)
Published
Sep 4, 2024
Added
May 15, 2025
Modified
May 15, 2025

Description

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

Solution

file-manager-plugin-cve-2024-7627
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.