Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for fileorganizer_manage_wordpress_and_website_files by softaculous

    CVE-2024-11010 (GCVE-0-2024-11010)

    Vulnerability from nvd – Published: 2024-12-07 09:27 – Updated: 2026-04-08 17:06
    VLAI
    Title
    FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion
    Summary
    The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'default_lang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-12-09 16:09 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2200 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    softaculous FileOrganizer – WordPress File Manager Affected: 0 , ≤ 1.1.4 (semver)
    		Create a notification for this product.
    softaculous fileorganizer_manage_wordpress_and_website_files Affected: 0 , ≤ 1.1.4 (semver)
        cpe:2.3:a:softaculous:fileorganizer_manage_wordpress_and_website_files:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    TANG Cheuk Hei
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:softaculous:fileorganizer_manage_wordpress_and_website_files:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fileorganizer_manage_wordpress_and_website_files",
            "vendor": "softaculous",
            "versions": [
              {
                "lessThanOrEqual": "1.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11010",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T16:09:15.783674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T17:33:33.732Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FileOrganizer \u2013 WordPress File Manager",
          "vendor": "softaculous",
          "versions": [
            {
              "lessThanOrEqual": "1.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "TANG Cheuk Hei"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FileOrganizer \u2013 Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the \u0027default_lang\u0027 parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:06:24.592Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e958653-36c4-4979-89e1-d9411a35a92a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/init.php#L222"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/fileorganizer.php#L149"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3201635/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-12-06T21:06:15.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FileOrganizer \u003c= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-11010",
    "datePublished": "2024-12-07T09:27:05.743Z",
    "dateReserved": "2024-11-08T00:40:26.083Z",
    "dateUpdated": "2026-04-08T17:06:24.592Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-11010 (GCVE-0-2024-11010)

    Vulnerability from cvelistv5 – Published: 2024-12-07 09:27 – Updated: 2026-04-08 17:06
    VLAI
    Title
    FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion
    Summary
    The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'default_lang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-12-09 16:09 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2200 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    softaculous FileOrganizer – WordPress File Manager Affected: 0 , ≤ 1.1.4 (semver)
    		Create a notification for this product.
    softaculous fileorganizer_manage_wordpress_and_website_files Affected: 0 , ≤ 1.1.4 (semver)
        cpe:2.3:a:softaculous:fileorganizer_manage_wordpress_and_website_files:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    TANG Cheuk Hei
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:softaculous:fileorganizer_manage_wordpress_and_website_files:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fileorganizer_manage_wordpress_and_website_files",
            "vendor": "softaculous",
            "versions": [
              {
                "lessThanOrEqual": "1.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11010",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T16:09:15.783674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T17:33:33.732Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FileOrganizer \u2013 WordPress File Manager",
          "vendor": "softaculous",
          "versions": [
            {
              "lessThanOrEqual": "1.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "TANG Cheuk Hei"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FileOrganizer \u2013 Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the \u0027default_lang\u0027 parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:06:24.592Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e958653-36c4-4979-89e1-d9411a35a92a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/init.php#L222"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/fileorganizer.php#L149"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3201635/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-12-06T21:06:15.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FileOrganizer \u003c= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-11010",
    "datePublished": "2024-12-07T09:27:05.743Z",
    "dateReserved": "2024-11-08T00:40:26.083Z",
    "dateUpdated": "2026-04-08T17:06:24.592Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}