FileOrganizer CVE-2026-11962

Exploitation requires an authenticated WordPress account that has been granted file-manager access within FileOrganizer (CVSS PR:L confirms low-privilege authentication is needed, so this is not exploitable by anonymous visitors). The premium add-on materially widens exposure by allowing file-manager access to be extended to sub-administrator roles, so environments running the premium add-on with delegated roles face the broadest attacker pool. The specific vulnerable surface is the plugin's file-management operations OTHER than the primary upload (which CVE-2024-7985 already fixed), where file-type validation is absent - the attacker must route the malicious PHP file through one of those operations. Limiting factors: an attacker must first obtain a file-manager-capable account, no exploitation is possible without that grant, and sites that keep file-manager capability restricted to trusted admins and do not enable the sub-administrator extension are far less exposed.

This is a genuine priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with plugin-to-RCE on WordPress. Publicly available exploit code exists, raising near-term risk, though this should not be conflated with active exploitation: it is not listed in CISA KEV, so it counts as no confirmed in-the-wild use at time of analysis. No EPSS score was provided in the input, and no SSVC decision data was supplied, so automatable/technical-impact classifications cannot be quoted here. The main limiting factor is the PR:L requirement - an attacker must already hold a file-manager-capable account (or a sub-administrator role if the premium add-on is installed), which narrows exposure on well-governed sites but is common on multi-user or membership WordPress installs.

An attacker who holds (or phishes/registers into) a low-privileged WordPress account with file-manager access uses the plugin's unvalidated file-management operation to write a PHP web shell into the site directory, then requests that file over HTTP to run arbitrary code as the web-server user. Because publicly available exploit code exists and the CVSS vector is AV:N/AC:L/UI:N, the attack is straightforward once the required file-manager privilege is obtained and needs no victim interaction.