8.8
Élevée
CVE-2026-11962 The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management…
Description
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| FileOrganizer 1.2 | premières → < 1.2.0 | 1.2.0 |
Autres CVE de FileOrganizer
Les 4 CVE de FileOrganizer →
CVE-2026-85081
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro …
7.5
Élevée
CVE-2026-6382
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager…
9.1
Critique
CVE-2023-3664
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site…
7.2
Élevée