CVE-2024-8743

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3161219/
https://www.wordfence.com/threat-intel/vulnerabilities/id/314520d5-bd9d-46c1-b903-5e5cb3bb3417?source=cve

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El complemento Bit File Manager – 100% Free & Open Source File Manager and Code Editor para WordPress es vulnerable a la carga limitada de archivos JavaScript en todas las versiones hasta la 6.5.7 incluida. Esto se debe a la falta de controles adecuados sobre los tipos de archivos permitidos. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor o superior, y con permisos otorgados por un administrador, carguen archivos .css y .js, lo que podría provocar cross-site scripting almacenado.

05 Oct 2024, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-05 07:15

Updated : 2026-06-17 08:23

NVD link : CVE-2024-8743

Mitre link : CVE-2024-8743

CVE.ORG link : CVE-2024-8743

JSON object : View

Products Affected

No product.

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2024-8743", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-8743", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-10-07T15:57:45.966898Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "bitpressadmin", "product": "File Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.5.7"}], "defaultStatus": "unaffected"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:bitapps:file_manager:*:*:*:*:*:wordpress:*:*"], "vendor": "bitapps", "product": "file_manager", "versions": [{"status": "affected", "version": "0", "lessThan": "6.5.8", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2024-10-05T07:15:12.297", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3161219/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/314520d5-bd9d-46c1-b903-5e5cb3bb3417?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "The Bit File Manager \u2013 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting."}, {"lang": "es", "value": "El complemento Bit File Manager \u2013 100% Free & Open Source File Manager and Code Editor para WordPress es vulnerable a la carga limitada de archivos JavaScript en todas las versiones hasta la 6.5.7 incluida. Esto se debe a la falta de controles adecuados sobre los tipos de archivos permitidos. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor o superior, y con permisos otorgados por un administrador, carguen archivos .css y .js, lo que podr\u00eda provocar cross-site scripting almacenado."}], "lastModified": "2026-06-17T08:23:13.473", "sourceIdentifier": "security@wordfence.com"}