CVE-2023-3664
📋 TL;DR
The FileOrganizer WordPress plugin through version 1.0.2 contains a privilege escalation vulnerability on WordPress multisite installations. Site administrators can exploit this to gain full server control, affecting all WordPress multisite instances using this plugin.
💻 Affected Systems
- WordPress FileOrganizer plugin
📦 What is this software?
Fileorganizer by Fileorganizer
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary code, access sensitive data, and potentially pivot to other systems.
Likely Case
Unauthorized site administrators gaining full control over the WordPress multisite network, potentially modifying all sites, stealing data, or installing backdoors.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented, though plugin functionality would still be compromised.
🎯 Exploit Status
Requires site administrator privileges on a WordPress multisite installation. Exploitation is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.3 or later
Vendor Advisory: https://wpscan.com/vulnerability/d59e6eac-3ebf-40e0-800c-8cbef345423f
Restart Required: No
Instructions:
1. Update FileOrganizer plugin to version 1.0.3 or later via WordPress admin panel. 2. Alternatively, remove the plugin entirely if not needed.
🔧 Temporary Workarounds
Disable plugin on multisite
linuxDeactivate and remove the FileOrganizer plugin from all multisite installations
wp plugin deactivate fileorganizer --network
wp plugin delete fileorganizer --network
🧯 If You Can't Patch
- Disable the FileOrganizer plugin on all multisite installations immediately.
- Implement strict access controls and monitor site administrator activities on WordPress multisite networks.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for FileOrganizer plugin version. If version is 1.0.2 or earlier on a multisite installation, the system is vulnerable.Check Version:
wp plugin get fileorganizer --field=versionVerify Fix Applied:
Verify FileOrganizer plugin version is 1.0.3 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file operations by site administrators
- Plugin activation/deactivation logs for FileOrganizer
- Unexpected privilege escalation attempts
Network Indicators:
- Unusual outbound connections from WordPress server
- File upload patterns matching plugin functionality
SIEM Query:
source="wordpress" AND (plugin="fileorganizer" OR message="FileOrganizer")