CVE-2026-11962 is a vulnerability in the FileOrganizer WordPress plugin prior to version 1.2.0. It involves CWE-434, an unrestricted upload of files with dangerous types. Authenticated users with file-manager privileges, including sub-administrator roles granted by a premium add-on, can upload arbitrary PHP files because the plugin does not properly validate file types on multiple file-management operations beyond just the upload function. This flaw allows attackers to achieve remote code execution. The vulnerability is a regression or incomplete fix of CVE-2024-7985, which only addressed file-type validation during the upload operation but neglected other file-management operations.

Successful exploitation allows an authenticated user with file-manager access to upload arbitrary PHP files, resulting in remote code execution on the affected system. This can lead to full compromise of the WordPress site and potentially the underlying server. The vulnerability requires at least low privileges (file-manager access) but no user interaction beyond authentication. The CVSS 3.1 base score is 8.8 (high severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been publicly disclosed as of the information provided. Until a patch is available, restrict file-manager access to trusted users only and consider disabling or removing the FileOrganizer plugin if possible. Monitor vendor channels for updates and apply any official fixes promptly once released.