CVE-2026-11962
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The FileOrganizer WordPress plugin before version 1.2.0 does not validate file types in several file management operations, allowing authenticated users with file manager access (which its premium add-on can extend to sub-administrator roles) to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file type validation to the upload operation.
Risk Assessment
The risk for the organization is the potential takeover of the server by an attacker with limited privileges, which can lead to data theft, content modification, or further spread of the attack within the network.
Recommendation
Immediately update the FileOrganizer plugin to version 1.2.0 or later, and restrict file manager access to trusted users only.
Original NVD description (English source)
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.