CyberRota Analysis
AI-GeneratedThe FileOrganizer WordPress plugin prior to version 1.2.0 is vulnerable due to insufficient file type validation, enabling authenticated users with file-manager access to upload arbitrary PHP files, which can lead to remote code execution. This vulnerability poses a significant risk, particularly for sites with sub-administrator roles granted access through the premium add-on. WordPress site administrators and security teams should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.