Arbitrary File Inclusion Vulnerability in FileOrganizer Plugin

CVE-2024-11010

Summary

The FileOrganizer – Manage WordPress and Website Files plugin contains a vulnerability that allows local JavaScript file inclusion through the 'default_lang' parameter. Authenticated users with Administrator-level access can exploit this flaw to include and execute arbitrary JavaScript files on the server. This exploitation can lead to unauthorized code execution, data breaches, and bypassing of access controls, especially when combined with attack vectors that permit uploading seemingly safe file types, such as images.

References