CVE-2024-7627
HIGHCVSS v3
8.1
HIGH
EPSS Score
39.7%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.
Technical Details
- Published
- 9/5/2024
Frequently Asked Questions
What is CVE-2024-7627?
The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.
Is CVE-2024-7627 actively exploited?
Active exploitation of CVE-2024-7627 has not been confirmed. The EPSS score is 39.7%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-7627?
CVE-2024-7627 has a CVSS v3 base score of 8.1 (HIGH severity).
Is CVE-2024-7627 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.