CVE-2024-8743: CWE-434 Unrestricted Upload of File with Dangerous Type in bitpressadmin File Manager
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
AI Analysis
Technical Summary
The Bit File Manager plugin for WordPress suffers from CWE-434: Unrestricted Upload of File with Dangerous Type. Authenticated users with Subscriber-level access and granted permissions can upload JavaScript and CSS files because the plugin lacks proper validation of allowed file types. This vulnerability can lead to stored cross-site scripting, potentially compromising the confidentiality and integrity of the affected WordPress site. The CVSS 3.1 base score is 6.8, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity.
Potential Impact
Successful exploitation allows an authenticated user with limited privileges to upload malicious JavaScript or CSS files, which can result in stored cross-site scripting. This may lead to unauthorized actions performed in the context of other users, data theft, or site defacement. Availability is not impacted. There are no known active exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions carefully to prevent unauthorized file uploads and consider disabling the plugin if not essential. Monitor for updates from the vendor and apply patches promptly once released.
CVE-2024-8743: CWE-434 Unrestricted Upload of File with Dangerous Type in bitpressadmin File Manager
Description
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Bit File Manager plugin for WordPress suffers from CWE-434: Unrestricted Upload of File with Dangerous Type. Authenticated users with Subscriber-level access and granted permissions can upload JavaScript and CSS files because the plugin lacks proper validation of allowed file types. This vulnerability can lead to stored cross-site scripting, potentially compromising the confidentiality and integrity of the affected WordPress site. The CVSS 3.1 base score is 6.8, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity.
Potential Impact
Successful exploitation allows an authenticated user with limited privileges to upload malicious JavaScript or CSS files, which can result in stored cross-site scripting. This may lead to unauthorized actions performed in the context of other users, data theft, or site defacement. Availability is not impacted. There are no known active exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions carefully to prevent unauthorized file uploads and consider disabling the plugin if not essential. Monitor for updates from the vendor and apply patches promptly once released.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-09-11T21:44:52.570Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6b30b7ef31ef0b54f241
Added to database: 2/25/2026, 9:35:44 PM
Last enriched: 4/9/2026, 8:29:39 PM
Last updated: 4/11/2026, 8:50:10 PM
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.