PT-2026-55867 · WordPress · Fileorganizer
Published
2026-07-06
·
Updated
2026-07-06
·
CVE-2026-11962
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FileOrganizer versions prior to 1.2.0
Description
Authenticated users with file-manager access, including sub-administrator roles granted via the premium add-on, can upload arbitrary PHP files. This is possible because the plugin fails to validate file types during several file-management operations, leading to remote code execution (RCE), which is the ability of an attacker to execute arbitrary commands on the server.
Recommendations
Update FileOrganizer to version 1.2.0 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fileorganizer