8.8
High
CVE-2026-11962 The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management…
Description
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FileOrganizer 1.2 | earliest → < 1.2.0 | 1.2.0 |
Other CVEs of FileOrganizer
The 4 CVEs of FileOrganizer →
CVE-2026-85081
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro …
7.5
High
CVE-2026-6382
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager…
9.1
Critical
CVE-2023-3664
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site…
7.2
High