CVE-2026-11962: FileOrganizer WordPress Plugin RCE Flaw

CVE-2026-11962 Overview

CVE-2026-11962 affects the FileOrganizer WordPress plugin in versions prior to 1.2.0. The plugin fails to validate file types across several file-management operations. Authenticated users granted file-manager access can upload arbitrary PHP files and achieve remote code execution on the WordPress host. The premium add-on extends file-manager access to sub-administrator roles, expanding the attackable population. This vulnerability is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation but left other file-management endpoints unprotected.

Critical Impact
Authenticated attackers with file-manager access can upload PHP webshells and execute arbitrary code on the underlying WordPress server.

Affected Products

FileOrganizer WordPress plugin versions prior to 1.2.0
FileOrganizer Premium add-on (extends exposure to sub-administrator roles)
WordPress installations where file-manager access has been delegated to non-administrator users

Discovery Timeline

2026-07-06 - CVE-2026-11962 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-11962

Vulnerability Analysis

The FileOrganizer plugin exposes multiple file-management operations to authenticated users, including upload, rename, move, copy, and archive-extraction endpoints. The original fix for CVE-2024-7985 added file-type validation only to the primary upload operation. Other endpoints continued to accept or produce files without validating extensions or MIME types. An attacker with file-manager access can bypass the upload restriction by staging a benign file and renaming it to .php, extracting an archive containing PHP payloads, or moving files into web-accessible locations. Once a PHP file lands under the WordPress document root, requesting the file executes attacker-controlled code under the web server user context.

Root Cause

The root cause is inconsistent input validation across the plugin's file-management handlers [CWE-434: Unrestricted Upload of File with Dangerous Type]. The fix for CVE-2024-7985 addressed a single code path rather than centralizing extension and MIME checks across all operations that write or rename files on disk.

Attack Vector

Exploitation requires authenticated access with the file-manager capability. Attackers can obtain this role through the premium add-on's sub-administrator delegation, compromised low-privileged accounts, or insider access. The attacker uses the plugin's rename, move, or extract functionality to place a .php file inside the WordPress installation. Requesting the file over HTTP triggers PHP execution and yields a webshell. Refer to the WPScan Vulnerability Advisory for technical specifics.

Detection Methods for CVE-2026-11962

Indicators of Compromise

New or unexpected .php files under wp-content/uploads/ or plugin-managed directories
HTTP POST requests to FileOrganizer AJAX actions such as fileorganizer_ajax invoking rename, move, or extract operations
Outbound network connections from the PHP-FPM or web server process to unfamiliar hosts shortly after file-management activity
WordPress audit-log entries showing sub-administrator or editor accounts performing file operations

Detection Strategies

Monitor web server access logs for requests to PHP files located in upload or media directories
Inspect WordPress plugin logs for file-management calls originating from non-administrator accounts
Baseline the file inventory of the WordPress document root and alert on new executable script files
Correlate authentication events with file-management API calls to identify anomalous role behavior

Monitoring Recommendations

Enable file integrity monitoring across the WordPress installation, particularly wp-content/uploads/
Forward WordPress and web server logs to a central SIEM for correlation and retention
Alert on process creation by the web server user spawning shells, curl, wget, or interpreters
Track EPSS scoring for CVE-2026-11962 to adjust prioritization as exploitation likelihood shifts

How to Mitigate CVE-2026-11962

Immediate Actions Required

Upgrade the FileOrganizer plugin to version 1.2.0 or later on all WordPress sites
Audit user roles and revoke file-manager access from any account that does not require it
Review the WordPress document root for unauthorized .php files and remove any webshells found
Rotate credentials for administrator, sub-administrator, and file-manager accounts on affected sites

Patch Information

The vendor addressed CVE-2026-11962 in FileOrganizer version 1.2.0 by extending file-type validation to the previously unprotected file-management operations. Site operators should update through the WordPress plugin dashboard or by installing the updated package from the official repository. Details are documented in the WPScan Vulnerability Advisory.

Workarounds

Deactivate the FileOrganizer plugin until the update to 1.2.0 can be applied
Restrict file-manager capabilities to administrator accounts only and disable the premium sub-administrator extension
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
Deploy a web application firewall rule blocking POST requests to FileOrganizer AJAX endpoints from non-administrator sessions

bash

# Apache: deny PHP execution inside the uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|php7|phar)$">
    Require all denied
</FilesMatch>