The FileOrganizer – WordPress File Manager plugin contains an insecure storage vulnerability (CWE-922) that exposes sensitive information to unauthenticated attackers. Specifically, the 'fileorganizer_ajax_handler' function can be exploited to retrieve sensitive data such as backups if these files reside in the Trash folder. This vulnerability affects all versions up to 1.0.7 and has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits are currently reported in the wild, and no patch or vendor advisory detailing remediation is available.

An unauthenticated attacker can extract sensitive information, including backups or other confidential files, from the plugin's Trash folder. This exposure can lead to data leakage without requiring any privileges or user interaction. The confidentiality impact is high, while integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the WordPress admin area and file directories, especially the Trash folder used by the plugin, to trusted users only. Monitoring for updates from the vendor or plugin repository is advised to apply any forthcoming official fixes promptly.