blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2020-25213

CRITICAL 9.8 CVSS 3.1
Published
September 9, 2020
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
cve@mitre.org
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • filemanagerpro file_manager — Before 6.9

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
  • packetstormsecurity.com http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
  • github.com https://github.com/w4fz5uck5/wp-file-manager-0day Exploit, Third Party Advisory
  • hotforsecurity.bitdefender.com https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html Broken Link, Third Party Advisory
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2373068 Patch
  • seravo.com https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/ Exploit, Third Party Advisory
  • wordfence.com https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/ Exploit, Third Party Advisory
  • wordpress.org https://wordpress.org/plugins/wp-file-manager/#developers Product, Release Notes
  • zdnet.com https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/ Press/Media Coverage
  • www.cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213 US Government Resource
  • nvd.nist.gov Official NVD record