WordPress · File Manager Plugin
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
Cos'è
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CISA: WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 3 maggio 2022
- Aggiunta all'elenco CISA
- 3 novembre 2021
- Pubblicato
- 9 settembre 2020
- Gravità
- Critica 10,0 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 97% tra il 0,1% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-434
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (9)
- https://wordpress.org/plugins/wp-file-manager/#developers
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability…
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-…
- https://plugins.trac.wordpress.org/changeset/2373068
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
Altre falle sfruttate di WordPress
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 25 set 2026 | Remote File Inclusion | Core | Alta 8,1 | 96% |
| 21 lug 2026 | SQL Injection | Core | Media 5,9 | 5,3% |
| 21 lug 2026 | Interpretation Conflict | Core | Critica 9,8 | 11% |
| 3 nov 2021 | Cross-Site Scripting (XSS) | Social Warfare Plugin | Media 6,1 | 73% |
| 3 nov 2021 | File Download | Snap Creek Duplicator Plugin | Alta 7,5 | 98% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.