The FileOrganizer – WordPress File Manager plugin suffers from a CWE-22 Path Traversal vulnerability that enables Local JavaScript File Inclusion through the 'default_lang' parameter. Authenticated users with administrator privileges can exploit this flaw to include and execute arbitrary JavaScript files on the server. This results in potential bypass of access controls, unauthorized data access, and code execution. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor patch or remediation guidance is currently available.

Successful exploitation allows an authenticated administrator to execute arbitrary JavaScript code on the server, potentially bypassing access controls, accessing sensitive data, and achieving code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file inclusion or JavaScript execution within the plugin. Avoid uploading untrusted files that could be included via the vulnerable parameter.