CVE-2024-7985: FileOrganizer WordPress Plugin RCE Flaw

CVE-2024-7985 Overview

The FileOrganizer plugin for WordPress contains an arbitrary file upload vulnerability in the fileorganizer_ajax_handler function. The flaw affects all versions up to and including 1.0.9. The plugin fails to validate file types when processing uploads through this AJAX handler.

Authenticated attackers with Subscriber-level access or above can upload arbitrary files to the server. The FileOrganizer Pro plugin must also be installed and active for Subscriber+ users to reach the vulnerable code path. Successful exploitation may lead to remote code execution on the affected WordPress site.

Critical Impact
Authenticated attackers can upload arbitrary files, including PHP webshells, potentially achieving remote code execution on the WordPress server.

Affected Products

FileOrganizer – Manage WordPress and Website Files plugin, versions up to and including 1.0.9
FileOrganizer Pro plugin (required to expose the flaw to Subscriber-level accounts)
WordPress sites permitting Subscriber-level registration with FileOrganizer installed

Discovery Timeline

2024-10-29 - CVE-2024-7985 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7985

Vulnerability Analysis

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. The fileorganizer_ajax_handler function processes file upload requests without enforcing a file type allowlist or denylist. Attackers can submit files with executable extensions such as .php, which the web server may then execute when accessed directly.

Because the plugin is designed as a file management utility, uploads land in web-accessible directories under the WordPress installation. This turns the missing validation into a direct path to code execution. Authentication is required, but Subscriber accounts are typically low-friction to obtain on sites that allow open registration.

Root Cause

The root cause is missing file type validation in the AJAX upload handler defined in main/ajax.php. The handler accepts arbitrary file content and writes it to the target directory without inspecting the extension, MIME type, or magic bytes. The Pro plugin extends the capability model to grant Subscriber-level roles access to this handler, expanding the exploitable population.

Attack Vector

An attacker registers or compromises a Subscriber account on a target WordPress site running FileOrganizer and FileOrganizer Pro. The attacker authenticates and issues a crafted POST request to the plugin's AJAX endpoint, invoking the fileorganizer_ajax_handler action. The request body contains a PHP file disguised as a benign upload.

The handler writes the file to a web-accessible location. The attacker then requests the uploaded file's URL, causing the web server to execute the PHP payload under the WordPress process context. From there, the attacker can pivot to database access, credential theft, or lateral movement. Refer to the Wordfence Vulnerability Report and the WordPress File Organizer Code for the vulnerable handler location.

Detection Methods for CVE-2024-7985

Indicators of Compromise

New PHP or executable files appearing under wp-content/ directories associated with the FileOrganizer plugin's upload paths
WordPress admin-ajax.php requests containing the fileorganizer_ajax_handler action originating from Subscriber-level accounts
Unexpected outbound connections from the web server process shortly after upload activity
Web shell signatures such as eval($_POST[...]), system(, or obfuscated base64 payloads within newly written files

Detection Strategies

Inspect access logs for POST requests to admin-ajax.php with action=fileorganizer_ajax_handler and correlate with low-privilege user sessions
Monitor filesystem events on WordPress content directories for creation of files with executable extensions
Alert on WordPress process spawning shell interpreters such as sh, bash, or cmd.exe

Monitoring Recommendations

Enable file integrity monitoring across wp-content/uploads/ and plugin directories
Forward WordPress and web server logs to a centralized SIEM for correlation with authentication events
Track user role assignments and flag unexpected escalations or new Subscriber registrations on sites where open signup is not required

How to Mitigate CVE-2024-7985

Immediate Actions Required

Update the FileOrganizer plugin to a version later than 1.0.9 on all WordPress sites
Audit installed plugins for FileOrganizer and FileOrganizer Pro presence and confirm current versions
Review user roles and remove unnecessary Subscriber accounts, disabling open registration where not required
Scan wp-content/ directories for unauthorized PHP files and investigate any matches

Patch Information

The vendor addressed the issue in the changeset referenced by the WordPress Changeset Update. Administrators should install the fixed version through the WordPress plugin manager or by deploying the updated release directly to the plugins directory.

Workarounds

Deactivate and remove FileOrganizer and FileOrganizer Pro until the patched version is installed
Restrict the plugin's AJAX action at the web server or web application firewall layer for non-administrator sessions
Configure the web server to deny PHP execution in upload directories using directory-level rules

bash

# Apache example: block PHP execution inside WordPress uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>