CVE-2020-25213

WordPress File Manager Plugin Remote Code Execution

10.0 CRITICALActively exploited (CISA KEV)Public exploitEPSS 97.3%

Published9 Sept 2020
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Filemanagerpro File Manager< 6.9

Remediation

Fixed in

Filemanagerpro File Manager≥ 6.9

Patch & vendor advisories

https://plugins.trac.wordpress.org/changeset/2373068

References

http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.htmlExploitThird Party AdvisoryVDB Entry
https://github.com/w4fz5uck5/wp-file-manager-0dayExploitThird Party Advisory
https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.htmlBroken LinkThird Party Advisory
https://plugins.trac.wordpress.org/changeset/2373068Patch
https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/ExploitThird Party Advisory
https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/ExploitThird Party Advisory
https://wordpress.org/plugins/wp-file-manager/#developersProductRelease Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213US Government Resource
https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/Press/Media Coverage

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2020-25213 being actively exploited?

Yes. CVE-2020-25213 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2020-25213?

CVE-2020-25213 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 97.3% probability of exploitation.

Which products are affected by CVE-2020-25213?

Affected products include Filemanagerpro File Manager.

How do I fix CVE-2020-25213?

Upgrade affected software to a fixed version, for example Filemanagerpro File Manager 6.9 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-25213 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.