Critical severity · published Sep 9, 2020
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
In wildKEV
9.8
CVSS
97.3%
EPSS
Yes
On KEV
Description
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)97.3% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · WordPress
All versions, or not specified · source: KEV
FM
File Manager · Filemanagerpro
before 6.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25213
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
wordpress.org
https://wordpress.org/plugins/wp-file-manager/#developers
github.com
https://github.com/w4fz5uck5/wp-file-manager-0day
hotforsecurity.bitdefender.com
https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
wordfence.com
https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/2373068
zdnet.com
https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
More from WordPress
9.8
CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
8.1
CVE-2026-87902
WordPress Core Remote File Inclusion Vulnerability
7.5
CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
6.1
CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability