WordPress · File Manager Plugin
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
What it is
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CISA: WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- September 9, 2020
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 97% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-434
- More details
- NVD · CVE.org · CISA
All references (9)
- https://wordpress.org/plugins/wp-file-manager/#developers
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability…
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-…
- https://plugins.trac.wordpress.org/changeset/2373068
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
More exploited flaws from WordPress
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 25, 2026 | Remote File Inclusion | Core | High 8.1 | 96% |
| Jul 21, 2026 | SQL Injection | Core | Medium 5.9 | 5.3% |
| Jul 21, 2026 | Interpretation Conflict | Core | Critical 9.8 | 11% |
| Nov 3, 2021 | Cross-Site Scripting (XSS) | Social Warfare Plugin | Medium 6.1 | 73% |
| Nov 3, 2021 | File Download | Snap Creek Duplicator Plugin | High 7.5 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.