High severity · published Sep 25, 2023
CVE-2023-3664
FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access
7.2
CVSS
0.8%
EPSS
No
On KEV
Description
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FileOrganizer ·
through 1.0.2 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3664
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3664
Third Party Advisory
https://wpscan.com/vulnerability/d59e6eac-3ebf-40e0-800c-8cbef345423f
More from FileOrganizer
9.1
CVE-2026-6382
Multiple elFinder Plugins - Authenticated OS Command Injection
8.8
CVE-2026-11962
FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations
7.5
CVE-2026-85081
Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass