CVE-2024-5599: 
WordPress vulnerability analysis and mitigation

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.0.7. The vulnerability exists in the 'fileorganizer_ajax_handler' function, which allows unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder (Wordfence Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction, and potentially results in high confidentiality impact (NVD Database).

The vulnerability allows unauthenticated attackers to access and extract sensitive data, including backups and other confidential information, specifically when these files have been moved to the plugin's built-in Trash folder (Wordfence Advisory).

The vulnerability can be exploited by unauthenticated attackers through the 'fileorganizer_ajax_handler' function, requiring no special privileges or user interaction (NVD Database).

A patch has been released in version 1.0.8 of the FileOrganizer plugin. Users are advised to update to this version or later to address the vulnerability (WordPress Plugin).