blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-0818

MEDIUM 6.5 CVSS 3.1
Published
August 13, 2025
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-22
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Description

Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.

Affected WordPress components

  • Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution Plugin · file-manager-advanced
    Confirmed match Active
    Up to and including 5.3.6
    View on WordPress.org
  • File Manager Pro – Filester Plugin · filester
    Confirmed match Active
    Up to and including 1.8.9; Up to and including 8.4.2
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • ninjateam File Manager Pro – Filester — Up to and including 1.8.9
  • saadiqbal Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution — Up to and including 5.3.6
  • File Manager File Manager Pro — Up to and including 8.4.2

References

  • github.com https://github.com/Studio-42/elFinder
  • github.com https://github.com/Studio-42/elFinder/blob/master/php/elFinder.class.php#L5367
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/library/php/elFinder.class.php#L5411
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/lib/php/elFinder.class.php#L5378
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/lib/php/elFinder.class.php
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3319016/filester
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3335715/file-manager-advanced/trunk/application/library/php/elFinder.class.php
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a166de-3bdf-4883-91ba-655f2757c53b?source=cve
  • nvd.nist.gov Official NVD record