Critical severity · published Jul 6, 2026
CVE-2026-6382
Multiple elFinder Plugins - Authenticated OS Command Injection
9.1
CVSS
1.4%
EPSS
No
On KEV
Description
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Advanced File Manager ·
before 5.4.12 · source: vendor
FM
File Manager ·
before 8.0.4 · source: vendor
FM
File Manager Pro ·
before 2.1.1 · source: vendor
FI
FileOrganizer ·
before 1.1.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6382
wpscan.com
https://wpscan.com/vulnerability/a27f70b7-a4cc-42fa-88c1-19adfe1593a8/
More from Advanced File Manager
8.5
CVE-2026-11565
Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui
7.1
CVE-2026-79627
Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
4.9
CVE-2023-3814
Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access