CVE-2024-7627

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

• CWE-94
• CWE-362

• https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L39Product
• https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L88Product
• https://plugins.trac.wordpress.org/changeset/3138710/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5f29de7a-3f15-4b6d-aad7-6a08151e2113?source=cveThird Party Advisory

Published

Sep 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7620The Customizer Export/Import plugin for WordPress is vulnera…6.6
• CVE-2024-7621The Visual Website Collaboration, Feedback & Project Managem…5.4
• CVE-2024-7622The Revision Manager TMC plugin for WordPress is vulnerable …4.3
• CVE-2024-7624The Zephyr Project Manager plugin for WordPress is vulnerabl…8.1
• CVE-2024-7625In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6…5.8
• CVE-2024-7626The WP Delicious – Recipe Plugin for Food Bloggers (formerly…8.1
• CVE-2024-7628The MStore API – Create Native Android & iOS Apps On The Clo…8.1
• CVE-2024-7629The Responsive video plugin for WordPress is vulnerable to S…5.4
• CVE-2024-7630The Relevanssi – A Better Search plugin for WordPress is vul…7.5
• CVE-2024-7631A flaw was found in the OpenShift Console, an endpoint for p…4.3
• CVE-2024-7633Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-7634NGINX Agent's "config_dirs" restriction feature allows a hig…4.9