EUVD-2026-41821
GHSA-mfx2-4vh3-fj3j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable operation with no user interaction, but a granted file-manager account is required (PR:L); arbitrary PHP upload yields full code execution, so C/I/A all High.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access - which its premium add-on can extend to sub-administrator roles - to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
Articles & Coverage 2
AnalysisAI
Authenticated remote code execution in the FileOrganizer WordPress plugin before 1.2.0 lets users granted file-manager access upload arbitrary PHP files because several file-management operations skip file-type validation. Publicly available exploit code exists, and the flaw is an incomplete fix of CVE-2024-7985, which only hardened the upload operation while leaving other file-management endpoints unvalidated. With CVSS 3.1 base 8.8 (PR:L) and a working PoC, any low-privileged account with file-manager rights - extendable to sub-administrator roles via the premium add-on - can achieve full site compromise.
Technical ContextAI
FileOrganizer is a WordPress file-management plugin that exposes web-based file operations (upload, copy, rename, move, extract) to users granted file-manager capability. The root cause is a missing/incomplete file-type (extension/MIME) validation on file-management operations other than the primary upload path - an unrestricted file upload weakness (CWE-434 class; NVD lists CWE as N/A). Because WordPress executes any .php file placed under the webroot when requested, writing a PHP payload through an unvalidated operation yields code execution in the web server context. CPE coverage is limited to cpe:2.3:a:unknown:fileorganizer:*:*:*:*:*:*:*:*, reflecting an incomplete NVD CPE record with vendor listed as 'unknown'. Notably, CVE-2024-7985 added validation only to the upload operation, so this CVE addresses the residual bypasses through the plugin's other file-handling endpoints.
RemediationAI
Vendor-released patch: upgrade the FileOrganizer plugin to version 1.2.0 or later, which adds the file-type validation missing from the additional file-management operations left unfixed by CVE-2024-7985; confirm the premium add-on is updated in step with the core plugin. Until the update is applied, restrict which accounts hold file-manager capability and remove the add-on grant that extends file-manager access to sub-administrator roles, so only fully trusted administrators retain access; if the file manager is not essential, deactivate the plugin entirely (side effect: staff lose in-dashboard file management). As a defense-in-place measure, deny PHP execution in WordPress upload/content directories via web-server configuration (side effect: may break plugins that legitimately execute files from those paths) and monitor the webroot for newly written .php files. Refer to the WPScan advisory at https://wpscan.com/vulnerability/88390679-80c5-439f-89d1-2f46aff8cfdb/ for details.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today