CVE-2026-6382
Deferred Deferred - Pending Action

Authenticated OS Command Injection in FileOrganizer WordPress Plugin

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: WPScan

Description
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-26
AI Q&A
2026-07-06
EPSS Evaluated
2026-07-25
NVD
CVE-2026-6382
EUVD
EUVD-2026-41812

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
fileorganizer file_organizer to 1.1.9 (exc)
file-manager-advanced file_manager_advanced to 5.4.12 (exc)
filester filester to 2.1.1 (exc)
wp-file-manager wp_file_manager to 8.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-6382 is a vulnerability in multiple WordPress plugins related to file management, including FileOrganizer, Advanced File Manager, File Manager Pro, and File Manager. The issue arises because these plugins do not properly escape a parameter before passing it to a shell command during image processing operations.

This improper escaping allows authenticated users to perform OS Command Injection, meaning they can execute arbitrary commands on the server. This exploit requires the server to have the ImageMagick convert CLI tool available and not use the PHP imagick or GD extensions.

The vulnerability is classified as a Remote Code Execution (RCE) issue and has a critical CVSS score of 9.1. It falls under the OWASP Top 10 category A1: Injection (CWE-94).

Impact Analysis

This vulnerability can have severe impacts because it allows authenticated users to execute arbitrary operating system commands on the server hosting the WordPress site.

Such OS Command Injection can lead to full compromise of the server, including unauthorized access to sensitive data, modification or deletion of files, installation of malware, or using the server as a launch point for further attacks.

Because the exploit requires authentication, attackers need some level of access, but once exploited, the damage can be critical.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, immediately update the affected WordPress plugins to their fixed versions or later.

  • Update FileOrganizer plugin to version 1.1.9 or later.
  • Update Advanced File Manager plugin to version 5.4.12 or later.
  • Update File Manager Pro plugin to version 2.1.1 or later.
  • Update File Manager plugin to version 8.0.4 or later.

Additionally, ensure that the server environment is secured by limiting access to the ImageMagick convert CLI tool and consider disabling it if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart