The FileOrganizer WordPress plugin before version 1.2.0 lacks proper file type validation during several file‑management operations. This oversight allows authenticated users who possess file‑manager privileges—permissions that can be granted to sub‑administrators through a premium add‑on—to upload arbitrary PHP files. Once uploaded, these files can be executed on the server, providing attackers with full remote code execution capabilities. The vulnerability is a direct result of missing validation logic in the plugin’s elFinder integration, as noted in the incomplete fix of a prior CVE.

This vulnerability impacts the FileOrganizer WordPress plugin, specifically all releases older than 1.2.0. Users running the plugin on their WordPress sites who have been granted file‑manager access, whether through base functionality or the mentioned premium add‑on, are susceptible. No other vendors or products are listed as affected.

The flaw carries a CVSS score of 8.8, suggesting a high‑severity impact. The EPSS score is reported as <1%, indicating a low probability of exploitation at present, and the issue is not yet cataloged in the CISA KEV list. Attackers would first need to authenticate to the WordPress site and acquire file‑manager privileges, after which they can use the elFinder interface to upload malicious PHP files. Once executed, the attacker gains unrestricted command execution on the server. The vulnerability is therefore exploitable under typical authenticated conditions and can lead to complete compromise of the affected site.