WordPress · File Manager Plugin
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
O que é
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CISA: WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 3 de maio de 2022
- Adicionada à lista da CISA
- 3 de novembro de 2021
- Publicada
- 9 de setembro de 2020
- Gravidade
- Crítica 10,0 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 97% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-434
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (9)
- https://wordpress.org/plugins/wp-file-manager/#developers
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability…
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-…
- https://plugins.trac.wordpress.org/changeset/2373068
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
Mais falhas exploradas de WordPress
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 25 de set. de 2026 | Remote File Inclusion | Core | Alto 8,1 | 96% |
| 21 de jul. de 2026 | SQL Injection | Core | Média 5,9 | 5,3% |
| 21 de jul. de 2026 | Interpretation Conflict | Core | Crítica 9,8 | 11% |
| 3 de nov. de 2021 | Cross-Site Scripting (XSS) | Social Warfare Plugin | Média 6,1 | 73% |
| 3 de nov. de 2021 | File Download | Snap Creek Duplicator Plugin | Alto 7,5 | 98% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.