WordPress · File Manager Plugin
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
Was es ist
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CISA: WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Was zu tun ist
Apply updates per vendor instructions.
Frist für US-Bundesbehörden: 3. Mai 2022
- Zur CISA-Liste hinzugefügt
- 3. November 2021
- Veröffentlicht
- 9. September 2020
- Schweregrad
- Kritisch 10,0 CVSS 3.1
- Wahrscheinlichkeit von Angriffen in den nächsten 30 Tagen (EPSS)
- 97% unter den obersten 0,1% aller bekannten Schwachstellen
- Schwachstellentyp
- CWE-434
- Mehr Details
- NVD · CVE.org · CISA
Alle Quellen (9)
- https://wordpress.org/plugins/wp-file-manager/#developers
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability…
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-…
- https://plugins.trac.wordpress.org/changeset/2373068
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
Weitere ausgenutzte Schwachstellen von WordPress
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 25.09.2026 | Remote File Inclusion | Core | Hoch 8,1 | 96% |
| 21.07.2026 | SQL Injection | Core | Mittel 5,9 | 5,3% |
| 21.07.2026 | Interpretation Conflict | Core | Kritisch 9,8 | 11% |
| 03.11.2021 | Cross-Site Scripting (XSS) | Social Warfare Plugin | Mittel 6,1 | 73% |
| 03.11.2021 | File Download | Snap Creek Duplicator Plugin | Hoch 7,5 | 98% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.