CVE-2023-3664

FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access

The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.

Affected

FileOrganizer

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.80% chance of exploitation in the next 30 days, 56th percentile

Published

2023-09-25

Updated

2024-09-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d59e6eac-3ebf-40e0-800c-8cbef345423f

References

• CVE Record
• NVD entry