CVE-2024-7627CWE-94

Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

High · published September 5, 2024

CVSS v3.1
8.1
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02802 · 86.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-09-05T02:04Z
EPSS history
Timeline
  • 05 SEP 02:04Z
    Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition
    cvelistv5