VULNERABILITY INTELLIGENCE

CVE-2024-7627

CVSS score8.1 HIGH
EPSS probability2.80%
CISA KEVNot currently listed
Published2024-09-05
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

Weakness classification

  • security@wordfence.com: CWE-94
  • nvd@nist.gov: CWE-362

Primary references