CVE-2024-7627

This PoC exploits a race condition in WordPress plugin Bit File Manager (versions 6.0-6.5.5) to achieve unauthenticated remote code execution via a temporary file in a publicly accessible directory. The script uses asynchronous requests to win the race condition and execute arbitrary commands.

This is a functional PoC exploit for CVE-2024-7627, leveraging a race condition in the Bit File Manager WordPress plugin to achieve unauthenticated RCE via temporary PHP file creation and execution.