CVE Watch6 jul 2026

CVE-2026-6382

The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin

CVSS

9.1

Crítico

EPSS

0.9%

p56

KEV

—

Exploit Today

0-100

Publicado: 6 jul 2026 · Última mod.: 6 jul 2026

EPSS · 30d

0.5%EPSS · 30 días0.9%

2026-07-062026-07-16

Descripción técnica

The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.

Referencias oficiales

wpscan.comhttps://wpscan.com/vulnerability/a27f70b7-a4cc-42fa-88c1-19adfe1593a8/

CVEs relacionados

Sin CVEs relacionados por CWE o producto.