CVE-2023-3664high

CVE-2023-3664: high-severity vulnerability in FileOrganizer

FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access

Published · Updated

Follow this CVE+ Monitor FileOrganizer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.8%
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · FileOrganizer
Related CVEs — FileOrganizer

In the same product, most dangerous first.

CVE-2026-6382CRITICALMultiple elFinder Plugins - Authenticated OS Command InjectionEPSS 1.4%CVE-2026-11962HIGHFileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File OperationsEPSS 0.7%CVE-2026-85081HIGHMultiple elFinder Plugins - DOM-based XSS via postMessage Origin BypassEPSS 0.2%