CVE-2026-17540

The CVE describes a vulnerability in the WordPress File Manager plugin prior to version 6.9.1. The issue is improper authorization of file management commands, allowing any authenticated user (e.g., a subscriber) to read and delete arbitrary files under the WordPress installation directory. This ...

CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...