PT-2020-6318 · WordPress · Wp File Manager

Catalin Cimpanu + 1 · Published 2020-09-09 · Updated 2026-01-13 · CVE-2020-25213

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions wp-file-manager plugin versions prior to 6.9

Description The issue allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. The issue was exploited in the wild in August and September 2020. Approximately 42% of users who installed the plugin were still vulnerable to this attack at the time of a post about it.

Recommendations For versions prior to 6.9, update the wp-file-manager plugin to version 6.9 or later to resolve the issue. As a temporary workaround, consider disabling the elFinder upload functionality until a patch is available. Restrict access to the wp-content/plugins/wp-file-manager/lib/files/ directory to minimize the risk of exploitation. Avoid using the elFinder connector file with the .php extension in the affected plugin until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-04175

CVE-2020-25213

Affected Products

Wp File Manager

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_file_manager_rce.rb · Exploit
• 🔥 https://github.com/w4fz5uck5/wp-file-manager-0day · Exploit
• 🔥 https://github.com/mansoorr123/wp-file-manager-CVE-2020-25213 · Exploit
• 🔥 https://github.com/BLY-Coder/Python-exploit-CVE-2020-25213 · Exploit
• 🔥 https://github.com/kakamband/WPKiller · Exploit
• 🔥 https://exploit-db.com/exploits/49178 · Exploit
• 🔥 https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager · Exploit
• 🔥 http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html · Exploit
• 🔥 https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin · Exploit
• 🔥 https://exploit-db.com/exploits/51224 · Exploit
• 🔥 http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25213 · Security Note
• https://plugins.trac.wordpress.org/changeset/2373068 · Patch
• https://osv.dev/vulnerability/CVE-2020-25213 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04175 · Security Note