GCVE - cpe:2.3:a:bitapps:file_manager:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bitapps:file_manager:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Bitapps (`f58f35eb-93f9-599d-b6d5-68faa76ec9db`)
Product	File Manager (`692c9ba7-c327-5cc9-8c33-e0f1e937f1c3`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/bit-apps-pro/file-manager`	purl2cpe	2026-06-01 10:14:57.893963

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-8743`	vulnerable	2026-06-08 07:00:25.500804	Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload MEDIUM (6.8) The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting. Published: 2024-10-05T06:44:10.696Z Updated: 2026-04-08T16:45:05.656Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/314520d5-bd9d-46c1-b903-5e5cb3bb3417?source=cve https://plugins.trac.wordpress.org/changeset/3161219/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7770`	vulnerable	2026-06-08 06:58:23.400138	Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload HIGH (8.8) The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. Published: 2024-09-10T10:59:05.034Z Updated: 2026-04-08T17:11:28.275Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/9cae7702-e531-45b9-9131-42edbc073a07?source=cve https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Http/Controllers/FileManagerController.php#L26 https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinderConnector.class.php#L160 https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinder.class.php#L1210 https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinder.class.php#L3257	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7627`	vulnerable	2026-06-08 06:58:22.883187	Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition HIGH (8.1) The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions. Published: 2024-09-05T02:04:24.643Z Updated: 2024-09-05T13:32:49.769Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/5f29de7a-3f15-4b6d-aad7-6a08151e2113?source=cve https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L39 https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L88 https://plugins.trac.wordpress.org/changeset/3138710/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5907`	vulnerable	2026-06-08 06:19:45.060717	File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files. Published: 2023-12-11T19:22:37.067Z Updated: 2025-05-27T14:42:08.040Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/f250226f-4a05-4d75-93c4-5444a4ce919e	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-47599`	vulnerable	2026-06-08 05:50:40.793391	WordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object Injection MEDIUM (5.5) Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress \| Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress \| Bit File Manager: from n/a through 5.2.7. Published: 2023-12-20T17:42:53.746Z Updated: 2026-04-28T16:07:58.292Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/file-manager/wordpress-bit-file-manager-100-free-file-manager-for-wordpress-plugin-5-2-7-php-object-injection?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.