CVE-2026-17541
Received Received - Intake

Unauthenticated File Activity Log Exposure in File Manager WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-17541
EUVD
EUVD-2026-55040

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bit_file_manager bit_file_manager to 6.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Bit File Manager WordPress plugin before version 6.9.1. It lacks authorization checks on a REST API route, allowing unauthenticated users to access and read the file activity log. This exposes sensitive details like file operations performed on the site, file paths involved, and usernames of users who performed those actions.

Detection Guidance

Check if the Bit File Manager plugin version is below 6.9.1 by inspecting the WordPress admin panel or using commands like 'wp plugin list' in WP-CLI. Monitor network traffic for unauthorized access to REST API routes associated with file activity logs.

Impact Analysis

An attacker could exploit this to view sensitive file operations and paths on your WordPress site, potentially revealing confidential data or user activity. This could lead to further attacks or privacy breaches if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. It may result in non-compliance, legal penalties, or reputational damage due to exposed user activity and file paths.

Mitigation Strategies

Update the Bit File Manager plugin to version 6.9.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review file activity logs for any suspicious access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart