CVE-2026-6382: Multiple WordPress File Manager Plugins OS command injection in image operations

CVE-2026-6382 · Severity: info · CVSS 9.1 · Published 2026-07-06

Multiple popular WordPress file management plugins are vulnerable to a security flaw that allows logged-in users to execute unauthorized commands on the web server. These plugins are typically used by administrators to manage site files directly through the WordPress dashboard. If exploited, an attacker could take full control of the website and its underlying server, potentially leading to data theft or complete service disruption.

Technologies: Mndpsingh287 File Manager. Vendors: Mndpsingh287.

Quick answers

Is CVE-2026-6382 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6382 being exploited in the wild.
How severe is CVE-2026-6382?
Informational severity, with a CVSS score of 9.1, published 6 July 2026.
Which products and versions are affected?
FileOrganizer < 1.1.9; Mndpsingh287 File Manager < 5.4.12; Modalwindow Advanced File Manager < 5.4.12; Ninja Team Filester < 2.1.1.
Is there a fix for CVE-2026-6382?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6382 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-6382?
Check whether you run FileOrganizer, Mndpsingh287 File Manager, Modalwindow Advanced File Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple WordPress plugins utilizing elFinder components fail to properly escape parameters before passing them to shell commands during image processing operations. This leads to an OS Command Injection vulnerability. The flaw is exploitable by authenticated users and specifically occurs when the server is configured to use the ImageMagick 'convert' CLI utility in the absence of the PHP imagick or GD extensions. An attacker can leverage this to execute arbitrary code with the privileges of the web server user. Patches have been released for all affected plugins (FileOrganizer 1.1.9, Advanced File Manager 5.4.12, Filester 2.1.1, and File Manager 8.0.4).

Affected products

  • Unknown FileOrganizer < 1.1.9
  • Unknown Advanced File Manager < 5.4.12
  • Unknown File Manager Pro (Filester) < 2.1.1
  • Unknown File Manager < 8.0.4

Timeline

  • 2026-06-15: disclosed: Initial public disclosure
  • 2026-07-06: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.