CVE-2024-7770: Bitapps File Manager RCE Vulnerability

CVE-2024-7770 Overview

CVE-2024-7770 is an arbitrary file upload vulnerability in the Bit File Manager plugin for WordPress, developed by Bitapps. The flaw exists in the upload function, which fails to validate file types before writing uploaded content to disk. All plugin versions up to and including 6.5.5 are affected. Authenticated users with Subscriber-level access or higher can exploit this flaw when an administrator has granted them upload permissions. Successful exploitation allows attackers to upload arbitrary files, including PHP web shells, which can lead to remote code execution on the WordPress server. The vulnerability is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers can upload arbitrary files and achieve remote code execution on affected WordPress sites running Bit File Manager 6.5.5 or earlier.

Affected Products

Bitapps File Manager plugin for WordPress, all versions up to and including 6.5.5
WordPress sites where administrators have granted upload permissions to Subscriber-level or higher users
Deployments matching CPE cpe:2.3:a:bitapps:file_manager:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2024-09-10 - CVE-2024-7770 published to the National Vulnerability Database (NVD)
2024-09-10 - Vendor fix committed via WordPress Changeset #3138710
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7770

Vulnerability Analysis

The Bit File Manager plugin exposes file management functionality through the FileManagerController and the bundled elFinder library. The upload function accepts files from authenticated users but does not enforce a server-side allowlist of permitted file extensions or MIME types. As a result, executable content such as .php files can be written to a web-accessible directory. Once written, an attacker can request the file directly through a browser to trigger PHP interpretation and execute arbitrary commands under the web server user context.

Because the plugin relies on WordPress role-based permissions plus an administrator-granted upload capability, exploitation requires low-privilege authenticated access. This is a common configuration on multi-user WordPress sites, membership portals, and customer collaboration platforms.

Root Cause

The root cause is missing file type validation in the upload handler. The vulnerable code paths reside in FileManagerController.php line 26, elFinder.class.php line 1210, elFinder.class.php line 3257, and elFinderConnector.class.php line 160. These handlers do not reject dangerous extensions such as .php, .phtml, or .phar before saving uploaded content to the file system.

Attack Vector

An authenticated attacker with Subscriber-level access and administrator-granted upload permissions submits a crafted upload request to the Bit File Manager endpoint. The request contains a malicious PHP payload disguised as, or directly named as, a web-executable file. Because validation is absent, the server writes the file to a directory served by the WordPress installation. The attacker then requests the uploaded file over HTTP to invoke code execution, establish persistence, or pivot to other assets. The attack requires no user interaction from an administrator once permissions have been granted.

Refer to the Wordfence Vulnerability Intelligence advisory for additional technical context.

Detection Methods for CVE-2024-7770

Indicators of Compromise

New or unexpected files with .php, .phtml, .phar, or .pht extensions inside directories managed by the Bit File Manager plugin
WordPress access logs showing POST requests to Bit File Manager upload endpoints from Subscriber-level user sessions
Outbound network connections from the web server process (php-fpm, apache2, www-data) to unfamiliar external hosts following an upload event
Web shell artifacts such as files invoking eval(), base64_decode(), system(), or passthru() in the WordPress wp-content/uploads tree

Detection Strategies

Compare current plugin version against 6.5.5 using WordPress site scanners or the wp plugin list command
Hunt for recently modified PHP files in wp-content directories using file integrity monitoring baselines
Correlate authenticated WordPress sessions of low-privilege accounts with upload activity followed by direct GET requests to the uploaded resource
Inspect web server logs for HTTP 200 responses to PHP files inside upload directories, which should typically be static content

Monitoring Recommendations

Enable file integrity monitoring on WordPress plugin and upload directories with alerting on new executable file types
Forward WordPress audit logs, PHP error logs, and web server access logs to a centralized analytics platform for correlation
Alert on any child process spawned by the PHP interpreter that executes shell utilities such as sh, bash, curl, or wget

How to Mitigate CVE-2024-7770

Immediate Actions Required

Update the Bit File Manager plugin to a version later than 6.5.5 that includes the fix from WordPress Changeset #3138710
Audit the Bit File Manager permission configuration and revoke upload capability from Subscriber and other low-privilege roles unless strictly required
Review wp-content/uploads and plugin-managed directories for unexpected PHP files and remove any confirmed web shells
Rotate WordPress administrator and user credentials if evidence of exploitation is found

Patch Information

The vendor addressed the missing file type validation in WordPress Changeset #3138710. Upgrade Bit File Manager to a version that supersedes 6.5.5. Verify the installed version through the WordPress admin plugins screen or by inspecting the plugin readme.txt after upgrade.

Workarounds

Temporarily deactivate the Bit File Manager plugin until the patched version is deployed
Deny PHP execution in WordPress upload directories using web server rules that block requests for .php, .phtml, and .phar files under wp-content/uploads
Restrict access to WordPress admin and plugin endpoints by IP allowlist where operationally feasible

bash

# Apache: block PHP execution inside the WordPress uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|pht)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent (add inside the server block)
location ~* /wp-content/uploads/.*\.(php|phtml|phar|pht)$ {
    deny all;
    return 403;
}