WordPress File Manager Plugin Remote Code Execution Vulnerability

CRITIQUE 9.8EXPLOITED (CISA KEV)CVE-2020-25213 · Published 09/09/2020 · updated 17/06/2026

WordPress File Manager Plugin Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
file manager filemanagerpro	`< 6.9`	`6.9`

Description

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

References

packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html · Exploit
w4fz5uck5/wp-file-manager-0day · Exploit
hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html · Broken Link
plugins.trac.wordpress.org/changeset/2373068 · Patch
seravo.com/blog/0-day-vulnerability-in-wp-file-manager · Exploit
wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin · Exploit
wordpress.org/plugins/wp-file-manager · Product
zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug · Press/Media Coverage
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-25213

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free