WordPress Bit File Manager plugin < 6.9.1 - Unauthenticated File Activity Log Disclosure vulnerability

Unauthenticated File Activity Log Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Bit File Manager versions 6.9.1...

EUVD-2026-55040

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-17541

The Bit File Manager WordPress plugin (versions before 6.9.1 ) is vulnerable to an unauthenticated file activity log disclosure due to missing authorization checks on a REST API route. This allows unauthorized actors to view logs of file operations performed on the site, including specific file p...

CVE-2026-17541: Exposure of Sensitive Information to an Unauthorized Actor

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

PT-2026-69366

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 6.9.1 Description Lack of authorization checks on a REST API route allows unauthenticated users to access the file activity log. This leads to the disclosure of file operations performed on the...