This vulnerability stems from an unsanitized parameter that is passed directly to the ImageMagick convert shell command during image processing operations in several WordPress file manager plugins. The flaw, classified as CWE‑78, manifests when the server does not have the PHP imagick or GD extensions installed, causing the plugin to fall back to invoking the convert command directly. An authenticated user with access to the plugin’s image manipulation functionality can then execute arbitrary operating system commands under the permissions of the web server process, effectively granting full code execution on the host.

Affected products are the WordPress plugins FileOrganizer before version 1.1.9, Advanced File Manager before 5.4.12, File Manager Pro before 2.1.1, and File Manager before 8.0.4. These plugins are sometimes installed on sites with the ImageMagick convert GD extensions, enabling the vulnerability.

The CVSS score of places the issue in the critical range, while the EPSS score of less than 1% indicates a low current exploitation probability. Exploitation requires authentication to the WordPress site and the presence of the ImageMagick convert command, and the absence of the PHP imagick or GD extensions; if achieved, an attacker could obtain full control of the underlying server.