Executive brief
FileOrganizer, a WordPress plugin used for managing files within the website dashboard, contains a security flaw that allows certain authorized users to upload dangerous files. By bypassing file type restrictions during specific management tasks, an attacker with file manager access can upload malicious scripts to the server. This could lead to a complete takeover of the website, allowing the attacker to steal data or disrupt operations.
Technical details
The FileOrganizer plugin for WordPress is vulnerable to authenticated arbitrary file upload due to insufficient file type validation across multiple elFinder-based file management operations. While a previous fix (CVE-2024-7985) addressed the primary upload function, other operations remained unprotected. An attacker with file-manager permissions—which can be granted to sub-administrator roles via the plugin's premium add-on—can exploit this to upload PHP files to the server. Successful exploitation results in Remote Code Execution (RCE) in the context of the web server. The issue is resolved in version 1.2.0.
Affected products
- Unknown FileOrganizer before 1.2.0
Timeline
- 2026-06-15: disclosed
- 2026-07-06: advisory: NVD publication date
- 2026-07-06: patched: Fixed in version 1.2.0