CVE-2020-35235

HIGH 8.8CVE-2020-35235 · Published 14/12/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
secure file manager themexa	`≤ 2.5`	No fix yet

Description

vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

References

blog.nintechnet.com/authenticated-rce-vulnerability-in-wordpress-secure-file-manager-plugin-unpatched · Exploit
wordpress.org/plugins/secure-file-manager · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free