CVE-2026-11962: CWE-434 Unrestricted Upload of File with Dangerous Type in FileOrganizer
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
AI Analysis
Technical Summary
CVE-2026-11962 is a vulnerability in the FileOrganizer WordPress plugin prior to version 1.2.0. It involves CWE-434, an unrestricted upload of files with dangerous types. Authenticated users granted file-manager access, including sub-administrator roles via a premium add-on, can upload arbitrary PHP files through several file-management operations that lack proper file type validation. This vulnerability enables remote code execution. The flaw represents an incomplete remediation of CVE-2024-7985, which only addressed file-type validation during the upload operation but did not cover other file-management functions.
Potential Impact
Successful exploitation allows authenticated users with file-manager privileges to upload arbitrary PHP files, leading to remote code execution on the affected system. This can compromise the integrity and confidentiality of the WordPress site and potentially the underlying server environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file-manager access to trusted users only and monitor for suspicious file uploads. Avoid granting file-manager permissions to sub-administrator roles via the premium add-on.
CVE-2026-11962: CWE-434 Unrestricted Upload of File with Dangerous Type in FileOrganizer
Description
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
CVSS v3.1
Score 8.8high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11962 is a vulnerability in the FileOrganizer WordPress plugin prior to version 1.2.0. It involves CWE-434, an unrestricted upload of files with dangerous types. Authenticated users granted file-manager access, including sub-administrator roles via a premium add-on, can upload arbitrary PHP files through several file-management operations that lack proper file type validation. This vulnerability enables remote code execution. The flaw represents an incomplete remediation of CVE-2024-7985, which only addressed file-type validation during the upload operation but did not cover other file-management functions.
Potential Impact
Successful exploitation allows authenticated users with file-manager privileges to upload arbitrary PHP files, leading to remote code execution on the affected system. This can compromise the integrity and confidentiality of the WordPress site and potentially the underlying server environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file-manager access to trusted users only and monitor for suspicious file uploads. Avoid granting file-manager permissions to sub-administrator roles via the premium add-on.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-11T08:10:42.468Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b579327e9c79719f90534
Added to database: 07/06/2026, 07:21:55 UTC
Last enriched: 07/06/2026, 07:36:56 UTC
Last updated: 07/07/2026, 03:26:56 UTC
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.