CVE-2026-6382 is a critical OS command injection vulnerability (CWE-94) affecting several WordPress file management plugins. The flaw arises from improper escaping of parameters passed to shell commands during image operations, enabling authenticated users to execute arbitrary OS commands. Exploitation requires the presence of the ImageMagick convert CLI on the server and the absence of PHP imagick or GD extensions. The affected plugins and their vulnerable versions are FileOrganizer before 1.1.9, Advanced File Manager before 5.4.12, File Manager Pro before 2.1.1, and File Manager before 8.0.4. No official patch or remediation level is currently provided in the data.

Successful exploitation allows authenticated users to execute arbitrary operating system commands with the privileges of the web server, potentially leading to full system compromise, data theft, or service disruption. The vulnerability impacts confidentiality, integrity, and availability (all rated high).

Patch status is not yet confirmed — check the vendor advisories for each affected plugin for current remediation guidance. Until patches are applied, restrict authenticated user privileges and ensure the server environment is hardened, including disabling or restricting access to the ImageMagick convert CLI or installing PHP imagick or GD extensions to mitigate the risk.