Arbitrary File Upload Vulnerability in FileOrganizer Plugin for WordPress

CVE-2024-7985

Summary

The FileOrganizer plugin for WordPress, versions up to and including 1.0.9, has a vulnerability due to inadequate file type validation in the 'fileorganizer_ajax_handler' function. This flaw enables authenticated users, particularly those with Subscriber-level permissions and above, to upload arbitrary files to the server. Should the FileOrganizer Pro plugin be active, these users can exploit this weakness, potentially leading to unauthorized remote code execution on the affected site.

References