CVE-2026-11962: FileOrganizer WordPress Plugin Arbitrary File Upload to RCE

Technical summary

CVE-2026-11962 is a file-type validation bypass affecting FileOrganizer before version 1.2.0. While the earlier CVE-2024-7985 addressed arbitrary file upload in the upload operation by adding file-type checks, several other file-management operations in the plugin lack equivalent validation. An authenticated user with file-manager access can exploit these unprotected operations to upload PHP files, achieving unauthenticated remote code execution (RCE) with the privileges of the web server. The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network accessibility, low attack complexity, and the requirement for valid user credentials.

Business impact

Successful exploitation grants attackers the ability to execute arbitrary code on the web server, enabling complete site compromise, data theft, malware distribution, and lateral movement into internal networks. Organizations relying on FileOrganizer for document management or using its premium add-on to delegate file management to sub-administrator accounts face elevated risk, as the attack surface extends beyond trusted administrators. The ability to upload PHP directly bypasses many WAF and file-integrity monitoring solutions that focus on known malicious signatures rather than executable type validation.

Affected systems

FileOrganizer WordPress plugin versions prior to 1.2.0 are affected. The vulnerability is most acute in deployments using the premium add-on, which allows sub-administrator role assignment of file-manager permissions. Any WordPress site running an unpatched version with users holding file-manager access—including shop managers, content editors, or custom roles granted via the premium tier—is vulnerable to exploit by those authenticated accounts.

Exploitability

Exploitation requires valid WordPress authentication and explicit file-manager access, placing the attack surface primarily within trusted-user boundaries. However, the premium add-on's delegation of file-manager permissions to sub-administrators lowers the barrier to exploitation compared to restricting access to full administrators. No user interaction, CSRF token, or out-of-band action is required once an authenticated user with the right role connects to the plugin. Proof of concept is straightforward: an attacker with valid credentials can craft a request to one of the unprotected file-management endpoints and upload a PHP payload.

Remediation

Update FileOrganizer to version 1.2.0 or later. Verify the update via the WordPress plugin dashboard or by checking the installed plugin version. Additionally, audit file-manager role assignments, especially via the premium add-on, to ensure only trusted administrators retain this access. Monitor uploads and review the wp-content/uploads directory for unexpected PHP files. Disable the FileOrganizer plugin entirely if an immediate update is not feasible and file management is not critical.

Patch guidance

Administrators should prioritize updating FileOrganizer to version 1.2.0 as soon as testing permits. Update via the WordPress admin dashboard (Plugins > Installed Plugins > FileOrganizer > Update), or download the patch directly from the plugin repository. Verify the update by checking Plugins > Installed Plugins and confirming the version number reflects 1.2.0 or higher. Test file-upload and file-management operations in a staging environment before deploying to production. After patching, review the premium add-on settings to confirm that sub-administrator role permissions align with your organizational security posture.

Detection guidance

Monitor WordPress access logs for POST or PUT requests to FileOrganizer file-management endpoints (typically /wp-admin/admin-ajax.php with FileOrganizer action parameters). Flag requests that upload files with .php extensions or double-extension obfuscation (e.g., .php.jpg). Inspect the wp-content/uploads directory for PHP files or unexpected executable content. Enable WordPress security logging plugins (e.g., Wordfence, Sucuri) configured to alert on file uploads by non-administrator roles. Query WordPress user role assignments to identify sub-administrators with file-manager access who may be at risk of compromise or insider abuse.

Why prioritize this

An CVSS score of 8.8 (HIGH) reflects the combination of network accessibility, low attack complexity, and high impact (confidentiality, integrity, availability). The vulnerability is particularly urgent because it is a regression—the vendor's previous fix for CVE-2024-7985 proved incomplete, suggesting the plugin may have additional unvalidated file operations. Organizations using the premium add-on to distribute file-manager permissions to multiple users should treat this as critical and patch immediately. The ability to upload PHP directly without user interaction or multi-step bypass makes this a practical, high-value target for lateral movement or persistent backdoor installation.

Risk score, explained

The CVSS 3.1 score of 8.8 is derived from: AV:N (Network Attack Vector) — the plugin is accessible remotely via HTTP; AC:L (Low Attack Complexity) — no special conditions or bypasses are required; PR:L (Low Privilege, Requires User Interaction: No) — only a valid WordPress user with file-manager role is needed, and no further authorization checks are present; S:U (Unchanged Scope) — the impact is confined to the affected component; C:H, I:H, A:H (High Confidentiality, Integrity, Availability Impact) — arbitrary code execution as the web server user compromises all three security properties. The score does not yet include KEV or active exploitation data, but the technical simplicity and clear attack path warrant high-priority remediation independent of exploit prevalence.

Frequently asked questions