CVE-2024-5599: FileOrganizer Information Disclosure Flaw

CVE-2024-5599 Overview

CVE-2024-5599 affects the FileOrganizer – Manage WordPress and Website Files plugin for WordPress in all versions up to and including 1.0.7. The flaw resides in the fileorganizer_ajax_handler function and exposes sensitive data to unauthenticated attackers. Files moved to the plugin's built-in Trash folder, including site backups, become retrievable over the network without credentials. The issue is classified under CWE-922: Insecure Storage of Sensitive Information and tracked by the Wordfence Vulnerability Analysis.

Critical Impact

Unauthenticated remote attackers can extract backups and other sensitive files stored in the plugin's Trash folder, leading to full disclosure of site content and credentials embedded in backup archives.

Affected Products

• FileOrganizer – Manage WordPress and Website Files plugin versions through 1.0.7
• WordPress sites running the vulnerable plugin with files moved to the built-in Trash folder
• Sites storing backups, database dumps, or configuration exports via FileOrganizer

Discovery Timeline

• 2024-06-07 - CVE-2024-5599 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-5599

Vulnerability Analysis

The FileOrganizer plugin exposes an AJAX endpoint handled by the fileorganizer_ajax_handler function. This handler does not enforce authentication or capability checks before serving file contents from the plugin's Trash directory. Any visitor able to reach the WordPress admin-ajax.php endpoint can request file paths under the trashed-items location and receive the file data back.

Backups and exports moved to Trash retain their original contents. Because WordPress backup archives commonly contain wp-config.php, database credentials, secret keys, and user data, exposure of these archives extends impact well beyond the plugin itself. The vulnerability has an EPSS score of 2.239% (84.8th percentile), indicating measurable interest from opportunistic scanners.

Root Cause

The root cause is insecure storage combined with missing access control on the AJAX handler. The plugin places trashed files in a location reachable through its own request handler without verifying the caller is an authenticated administrator. The vulnerable code path is visible in the WordPress File Organizer Code, and the corrective patch is recorded in WordPress Changeset #3098763.

Attack Vector

An unauthenticated attacker sends a crafted HTTP POST request to wp-admin/admin-ajax.php with the action parameter targeting the FileOrganizer handler. The request references a file inside the plugin's Trash directory. The server returns the file contents directly in the response. No user interaction or prior session is required.

The vulnerability manifests in the fileorganizer_ajax_handler function. See the Wordfence Vulnerability Analysis for full technical reproduction details.

Detection Methods for CVE-2024-5599

Indicators of Compromise

• HTTP POST requests to /wp-admin/admin-ajax.php containing action=fileorganizer_ajax_handler from unauthenticated sessions
• Large outbound responses from admin-ajax.php referencing paths inside the plugin's Trash directory
• Repeated enumeration requests probing filenames such as backup, .sql, .zip, or wp-config under the FileOrganizer trash path

Detection Strategies

• Inspect web server access logs for admin-ajax.php calls invoking the FileOrganizer action without an authenticated wordpress_logged_in cookie
• Alert on anonymous AJAX responses exceeding typical response sizes, which suggest file content delivery
• Cross-reference WordPress plugin inventory to identify hosts running FileOrganizer at version 1.0.7 or earlier

Monitoring Recommendations

• Enable WordPress audit logging for plugin activity, including file move and trash operations
• Forward web server logs to a centralized analytics platform to baseline normal admin-ajax.php behavior
• Monitor for outbound transfers of archive file types originating from WordPress hosts

How to Mitigate CVE-2024-5599

Immediate Actions Required

• Update the FileOrganizer plugin to a version later than 1.0.7 that includes the fix from changeset 3098763
• Empty the FileOrganizer Trash folder to remove any sensitive backups currently stored there
• Rotate any credentials, API keys, or secrets contained in backups that may have been exposed
• Review web server logs for prior anonymous requests to the fileorganizer_ajax_handler endpoint

Patch Information

The vendor addressed the issue in WordPress Changeset #3098763, which introduces capability and authentication checks within the AJAX handler. Administrators should apply the update through the WordPress plugin updater or by replacing the plugin files with the patched release.

Workarounds

• Deactivate and remove the FileOrganizer plugin until the patched version is deployed
• Block unauthenticated access to wp-admin/admin-ajax.php requests carrying the fileorganizer_ajax_handler action at the web application firewall layer
• Move all backups out of the WordPress webroot and store them in a location not served by the plugin

# Example WAF rule to block unauthenticated FileOrganizer AJAX calls
# (adjust syntax to match your WAF vendor)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1005599,msg:'Block CVE-2024-5599 FileOrganizer AJAX'"
  SecRule ARGS:action "@streq fileorganizer_ajax_handler" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"