CVE-2026-6382

Authenticated users can exploit a vulnerability in certain WordPress plugins by manipulating an unsecured parameter that is passed to a system command used for image processing, specifically when the ImageMagick convert CLI is accessible on the server but neither the PHP imagick nor GD extensions are installed. This allows attackers to inject arbitrary operating system commands. The affected plugins include FileOrganizer before version 1.1.9 and others.

Based on public CVE data (MITRE/NVD).