The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File M…

Multiple WordPress file manager plugins are vulnerable to OS Command Injection due to improper escaping of parameters passed to shell commands during image processing operations. Affected plugins include FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4). Authenticated users can exploit this vulnerability to execute arbitrary OS commands on the server. Exploitation requires the ImageMagick convert CLI to be available on the server without the PHP imagick or GD extensions installed. This represents a significant risk as authenticated attackers could achieve full server compromise.