CVE-2026-17540

Timing note: the fix shipped on 3 August 2026 and WPScan published on 4 August. The CVE record followed on 10 August. This is not a new disclosure.

CVE-2026-17540 is an access control flaw in Bit File Manager, a WordPress plugin by Bit Apps. On WordPress.org it is listed as "File Manager" under the slug file-manager, with 10,000+ active installations. It is a different plugin from WP File Manager.

WPScan, the CVE Numbering Authority, says versions before 6.9.1 do not properly authorise their file management commands. Any logged-in user, such as a Subscriber, can read and delete files under the WordPress installation directory. WPScan says this can expose the site's configuration secrets and cause a denial of service. CWE-284.

The flaw is not unauthenticated. WPScan says a logged-out request gets nothing. It also says reads stay inside the WordPress directory and that the researcher did not achieve code execution. The readable files include wp-config.php, with the database credentials and the authentication keys and salts.

The CVE record carries a CVSS 3.1 8.8 (High) score added by CISA-ADP. WPScan shows the same 8.8. The full vector is in the CVSS field. NVD published the entry on 10 August 2026, marks it Deferred, and has no score of its own. Patchstack rates it 8.1.

Wordfence tracks the same flaw as CVE-2026-15991, published on 6 August 2026, CVSS 8.8, CWE-862. It lists versions 6.0 to 6.9 and says deleting the right file can lead to code execution. The plugin changelog for 6.9.1 credits both researchers, daroo (Wordfence) and Artus KG (WPScan).

The fix is 6.9.1, tagged on WordPress.org on 3 August 2026. The current release is 6.9.2. The WPScan advisory includes a proof of concept. CISA has not added the CVE to the KEV catalog (catalog 2026.10.23, checked 26 October), and no source reports exploitation in the wild. This record does not reprint requests or payloads.

Read the full explainer.