FileOrganizer Plugin Allows Arbitrary PHP Upload via File Manager

The FileOrganizer WordPress plugin before version 1.2.0 contains an authentication bypass vulnerability that enables authenticated users with file-manager access to upload arbitrary PHP files and execute remote code on vulnerable servers. This represents a critical risk for WordPress installations using the plugin, particularly those with the premium add-on that extends file-manager permissions to sub-administrator roles. While CVE-2024-7985 attempted to patch file-type validation in the upload operation, this vulnerability demonstrates that validation was incomplete across multiple file-management operations, leaving the attack surface exposed. Organizations relying on this plugin face immediate risk of server compromise, data exfiltration, and lateral movement within their infrastructure.

Practitioners using Casky.ai would detect the attack patterns underlying this vulnerability through skills aligned with Execution and Defense Evasion techniques. The core pattern involves Abuse of Elevation Control Mechanism (T1548) combined with Unrestricted Upload of File with Dangerous Type (T1190-adjacent behavior), where authenticated users bypass file-type restrictions to achieve Code Execution (T1059). Casky's extended reasoning capabilities would flag suspicious file-manager activity including PHP file creation attempts, multiple failed validation checks, and post-upload code execution patterns. Security teams would observe findings highlighting the gap between authentication context (legitimate user access) and authorization scope (ability to upload executable files), along with indicators of post-exploitation activity such as new process creation or reverse shell connections originating from the web application.