CVE-2024-7985 FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload

What is CVE-2024-7985?

CVE-2024-7985 is a high-severity vulnerability in softaculous FileOrganizer – WordPress File Manager, published on 29 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: The FileOrganizer Pro plugin must be installed and active to allow Subscriber+ users to upload files.

Weakness: CWE-434

Which versions are affected by CVE-2024-7985?

It affects 1 product.

Products include Fileorganizer Fileorganizer.

How do I fix CVE-2024-7985?

Upgrade to a fixed version.

Is CVE-2024-7985 being exploited?

There is no known exploitation of CVE-2024-7985 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in softaculous FileOrganizer – WordPress File Manager

• CVE-2024-5599 FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing High 7.5
• CVE-2023-3664 FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access High 7.2
• CVE-2024-2324 FileOrganizer and FileOrganizer Pro <= 1.0.6 - Authenticated Stored Cross-Site Scripting Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v2w9-x3m8-jc6p.