CVE-2026-17542CWE-200information-disclosure

CVE-2026-17542

High · published August 10, 2026

CVSS v3.1

7.5

EPSS

Percentile

34.8

In the wild

Unconfirmed

What it is

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00416 · 34.8th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-08-10T11:16Z

References (1)

https://wpscan.com/vulnerability/d17f3de9-b0f9-4bbd-8a57-18cda9d43d79/ · [email protected]

EPSS history

Timeline

10 AUG 06:00Z
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
cvelistv5