🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress

Information

Software Type	Plugin
Software Slug	file-manager (view on wordpress.org)
Software Status	Active
Software Author	bitpressadmin
Software Website	bitapps.pro
Software Downloads	1,444,433
Software Active Installs	20,000
Software Record Last Updated	November 21, 2024

8 Vulnerabilities

Submit a Vulnerability

Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVE-2024-7770

Sep 9, 2024

Researcher: TANG Cheuk Hei (siunam)

Bit File Manager – 100% free file manager for WordPress <= 5.2.2 - Subscriber+ Arbitrary File Creation/Upload/Deletion

8.8

CVE-2022-0403

Mar 14, 2022

Researcher: Luan Pedersini

Bit File Manager <= 4.1.4 - Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVE ID Unknown

Mar 1, 2017

Researcher: David Vaartjes

Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

8.1

CVE-2024-7627

Sep 4, 2024

Researcher: TANG Cheuk Hei (siunam)

Bit File Manager <= 5.0.0 - Information Disclosure

7.5

CVE-2018-7204

Mar 2, 2018

Researcher: Colette Chamberland

Bit File Manager <= 5.2.7 - Authenticated (Admin+) PHP Object Injection

7.2

CVE-2022-47599

Apr 28, 2023

Researcher: rezaduty

Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload

6.8

CVE-2024-8743

Oct 4, 2024

Researcher: TANG Cheuk Hei (siunam)

File Manager <= 6.3 - Authenticated (Admin+) Arbitrary OS File Access via Path Traversal

2.2

CVE-2023-5907

Nov 20, 2023

Researcher: Dmitrii Ignatyev

Title	Status	CVE ID	CVSS	Researchers	Date
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload	Patched	CVE-2024-7770	8.8	TANG Cheuk Hei (siunam)	September 9, 2024
Bit File Manager – 100% free file manager for WordPress <= 5.2.2 - Subscriber+ Arbitrary File Creation/Upload/Deletion	Patched	CVE-2022-0403	8.8	Luan Pedersini	March 14, 2022
Bit File Manager <= 4.1.4 - Cross-Site Request Forgery to Arbitrary File Upload	Patched		8.8	David Vaartjes	March 1, 2017
Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition	Patched	CVE-2024-7627	8.1	TANG Cheuk Hei (siunam)	September 4, 2024
Bit File Manager <= 5.0.0 - Information Disclosure	Patched	CVE-2018-7204	7.5	Colette Chamberland	March 2, 2018
Bit File Manager <= 5.2.7 - Authenticated (Admin+) PHP Object Injection	Patched	CVE-2022-47599	7.2	rezaduty	April 28, 2023
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload	Patched	CVE-2024-8743	6.8	TANG Cheuk Hei (siunam)	October 4, 2024
File Manager <= 6.3 - Authenticated (Admin+) Arbitrary OS File Access via Path Traversal	Patched	CVE-2023-5907	2.2	Dmitrii Ignatyev	November 20, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation