Bit File Manager flaw lets any subscriber read wp-config.php, CVE-2026-17540

Timing note: this is not a new bug. The fix shipped on 3 August 2026. WPScan published its advisory on 4 August, and the CVE went public on 10 August. WPScan updated the entry on 22 October, which pushed it back into alert feeds. We cover it because a step-by-step proof of concept is public and many sites update plugins late.

What happened

CVE-2026-17540 is a flaw in Bit File Manager, a WordPress plugin by Bit Apps. It puts a full file browser inside the WordPress dashboard. WPScan says versions before 6.9.1 do not properly authorise their file commands.

The result: any logged-in user can read and delete files under the WordPress installation directory. That includes the lowest role, Subscriber. WPScan says the plugin even refuses that user its own admin screen, yet the file commands still run.

In plain terms, the plugin checked permissions in one part of the request but read the command from another. Requests built the "wrong" way skipped the check. WPScan credits researcher Artus KG.

The CVE record carries a CVSS 3.1 8.8 (High) score, added by CISA's ADP. WPScan shows the same 8.8. Patchstack rates it 8.1. NVD has not scored it and lists the entry as Deferred.

Who is affected

Sites running Bit File Manager before 6.9.1 are affected. On WordPress.org the plugin is listed as "File Manager", slug file-manager, with 10,000+ active installations. Do not confuse it with WP File Manager, a different plugin.

The risk is highest on sites that let visitors register. Think membership sites, shops, forums and online courses. Any of those accounts is enough. A logged-out attacker gets nothing, WPScan says.

Sites where only trusted staff have accounts face a smaller risk. A stolen or weak Subscriber password still opens the door, though.

What is confirmed

WPScan confirms reads and deletions of files under the WordPress root, with default plugin settings. Its write-up shows wp-config.php coming back in full. That file holds the database credentials and the site's authentication keys and salts.

Deleting a core file takes the site down. WPScan shows the homepage and login page failing with a fatal error afterwards. That is the denial-of-service side of the bug.

Wordfence tracks the same flaw as CVE-2026-15991, published on 6 August, CVSS 8.8. Its record covers versions 6.0 to 6.9. The plugin changelog for 6.9.1 credits both researchers, daroo (Wordfence) and Artus KG (WPScan).

Version 6.9.1 was tagged on WordPress.org on 3 August 2026 (changeset 3632660). It also fixed other bugs, including an activity log readable without login. The current release is 6.9.2, from 2 September.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23, checked 26 October 2026). The WPScan advisory includes a proof of concept. ThreatWire does not reprint it.

What is not confirmed

No source reports exploitation in the wild. CISA's own assessment, recorded on 11 August, says "exploitation: none". That can change fast for WordPress bugs with a public PoC.

Code execution is disputed. Wordfence and the plugin changelog say deleting the right file "can lead to" remote code execution. WPScan's researcher says no code execution was achieved, and that reads cannot leave the WordPress directory.

The affected range differs slightly. WPScan and the CVE record say every version before 6.9.1. Wordfence says 6.0 to 6.9. Either way, 6.9.1 is the fix.

There is no separate Bit Apps security bulletin. The GitHub advisory GHSA-mr78-php7-96p9 is unreviewed and lists no package.

What to do

Update Bit File Manager to 6.9.1 or later, ideally 6.9.2. That is the fix every source names. If you cannot update now, deactivate the plugin until you can.

The steps below are standard hardening, not vendor instructions.

Check your users. Review Subscriber and other low-role accounts, especially ones created recently. If you do not need open registration, turn it off.

Check your logs. WPScan's write-up shows the attack going through the plugin's connector on admin-ajax.php. Look for requests to that connector from low-privilege accounts before you updated.

If you ran a vulnerable version with untrusted accounts, assume wp-config.php may have been read. Change the database password and update wp-config.php. Regenerate the authentication keys and salts, which logs everyone out. Rotate any other secrets stored in that file.

Keep recent backups so you can restore any deleted file. For more WordPress plugin coverage, see our explainers on the Forminator unauthenticated file upload and the Visual Composer local file inclusion.

Sources: the WPScan advisory, the CVE.org and NVD entries, the Bit File Manager changelog and changeset 3632660 on WordPress.org, Wordfence Intelligence (CVE-2026-15991), Patchstack, the GitHub Advisory Database and the CISA KEV catalog.