CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Explanation of Vulnerability in Simple Terms
FileOrganizer WordPress plugin versions up to 1.0.7 contain an information disclosure vulnerability. An unauthenticated attacker can read sensitive files from the site without authorization. The plugin fails to properly restrict access to file operations, allowing direct retrieval of confidential data. Update to a version newer than 1.0.7 immediately.
What an attacker can do
Read sensitive files and data from the WordPress site without logging in.
Potential impact on your site
Attackers can access private files, configuration data, and other confidential information stored on your site.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
