PatchTheCVEfile manager vulnerabilities and fixes
Recent CVEs affecting file manager, with upgrade or downgrade steps. 8 tracked.
Also searched as: filemanager.
file manager has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-11-10. Highest priority: CVE-2024-7627 (score 55/100).
- CVE-2025-63678 HIGH 7.2 DOWNGRADE An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation F
- CVE-2024-8918 HIGH 7.4 UPGRADE The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up t
- CVE-2024-8746 HIGH 7.5 UPGRADE The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to
- CVE-2024-8507 HIGH 8.8 UPGRADE The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a
- CVE-2024-7770 HIGH 8.8 UPGRADE The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress
- CVE-2024-7627 HIGH 8.1 UPGRADE The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via
- CVE-2023-26321 MEDIUM 6.3 DOWNGRADE A path traversal vulnerability exists in the Xiaomi File Manager application product(international version)
- CVE-2018-25105 CRITICAL 9.8 UPGRADE The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check
FAQ
How do I fix file manager vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is file manager being exploited right now?
None of the tracked file manager CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which file manager CVE should I patch first?
CVE-2024-7627 currently ranks highest (55/100): The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via .