Vulnerability Description
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Filemanagerpro | File Manager | < 6.9 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-CoExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-UplExploitThird Party AdvisoryVDB Entry
- https://github.com/w4fz5uck5/wp-file-manager-0dayExploitThird Party Advisory
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-fileBroken LinkThird Party Advisory
- https://plugins.trac.wordpress.org/changeset/2373068Patch
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/ExploitThird Party Advisory
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vExploitThird Party Advisory
- https://wordpress.org/plugins/wp-file-manager/#developersProductRelease Notes
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-Press/Media Coverage
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-CoExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-UplExploitThird Party AdvisoryVDB Entry
- https://github.com/w4fz5uck5/wp-file-manager-0dayExploitThird Party Advisory
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-fileBroken LinkThird Party Advisory
- https://plugins.trac.wordpress.org/changeset/2373068Patch
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/ExploitThird Party Advisory
FAQ
What is CVE-2020-25213?
CVE-2020-25213 is a vulnerability with a CVSS score of 10.0 (CRITICAL). The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have...
How severe is CVE-2020-25213?
CVE-2020-25213 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-25213?
Check the references section above for vendor advisories and patch information. Affected products include: Filemanagerpro File Manager.