EUVD-2026-41812
GHSA-jr7f-4jpg-mh92
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
AC:H because it needs a non-default server config (ImageMagick convert present, no imagick/GD); PR:L for an authenticated plugin user; S:U as OS impact stems from the same web-app authority; full C/I/A from command execution.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
Articles & Coverage 3
AnalysisAI
OS command injection in a family of popular WordPress file-manager plugins - FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) - lets authenticated users inject arbitrary shell commands through an unescaped parameter passed to the ImageMagick convert CLI during image operations. Reported by WPScan, publicly available exploit code exists, though EPSS is modest at 0.52% (40th percentile) and CISA SSVC records exploitation as 'none'. Exploitation is real but gated: the server must fall back to the ImageMagick convert binary because neither the PHP imagick nor GD extension is installed.
Technical ContextAI
The affected components are WordPress file-management plugins that provide upload, edit, and image-processing features from the WP admin/dashboard context. When performing image operations (resize/convert/thumbnail), the plugins shell out to ImageMagick's 'convert' command-line tool as a fallback path used only when the PHP imagick and GD image extensions are both absent. A user-controlled parameter is concatenated into that shell command without proper escaping, so shell metacharacters break out of the intended argument and are executed by the OS. This is the classic OS Command Injection root cause (CWE-78, Improper Neutralization of Special Elements used in an OS Command); the NVD entry lists CWE as N/A, so the class here is inferred from the description. CPE strings confirm four distinct plugin products (cpe:2.3:a:unknown:fileorganizer, advanced_file_manager, file_manager_pro, and file_manager), all running as PHP code inside WordPress.
RemediationAI
Vendor-released patches are available - upgrade each plugin to its fixed version: FileOrganizer 1.1.9 or later, Advanced File Manager 5.4.12 or later, File Manager Pro 2.1.1 or later, and File Manager 8.0.4 or later. Consult the WPScan advisory (https://wpscan.com/vulnerability/a27f70b7-a4cc-42fa-88c1-19adfe1593a8/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-6382) before updating. If immediate patching is not possible, the most effective compensating control is to remove the ImageMagick convert dependency path: install and enable the PHP imagick or GD extension so the plugin uses the in-process library instead of shelling out to the convert binary (side effect: none functionally - this is the normal/preferred image backend and closes the vulnerable code path). Alternatively, remove or restrict access to the ImageMagick convert CLI on the web server, or tighten which WordPress roles can perform file/image operations to reduce the pool of authenticated users who can reach the feature (side effect: legitimate admins/editors may lose image-processing functionality until patched).
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today