Vulnerability record · CVE-2020-25213 · published 9 September 2020
CVE-2020-25213: WordPress File Manager plugin unauthenticated PHP upload RCE
FFilemanagerpro · File Manager
The wp-file-manager plugin before 6.9 ships an unsafe elFinder connector example file that gets renamed to a .php extension, leaving an unrestricted upload endpoint reachable without authentication. Attackers can use elFinder upload, mkfile or put commands to drop PHP code into the plugin's lib/files directory and execute it. It was exploited in the wild in August and September 2020 and is listed in CISA KEV.
Description
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution with a CVSS of 9.8, confirmed in-the-wild exploitation, KEV listing and near-maximum EPSS score.
What it is
The wp-file-manager plugin before 6.9 ships an unsafe elFinder connector example file that gets renamed to a .php extension, leaving an unrestricted upload endpoint reachable without authentication. Attackers can use elFinder upload, mkfile or put commands to drop PHP code into the plugin's lib/files directory and execute it. It was exploited in the wild in August and September 2020 and is listed in CISA KEV.
Impact
An unauthenticated attacker gains remote code execution on the WordPress host, allowing full compromise of the site and, depending on server configuration, the underlying system.
Attack surface
Reachable over the network through the exposed elFinder connector endpoint in the plugin; the CVSS vector shows no privileges or user interaction required.
Exploitation
Listed in CISA KEV (added 2021-11-03) and exploited in the wild in August and September 2020; EPSS 30-day probability is 0.97328 (99.893rd percentile) and multiple references are tagged Exploit.
What to do
- Update the wp-file-manager plugin to 6.9 or later immediately; the fix is in changeset 2373068.
- If the plugin is not needed, remove or deactivate it entirely.
- Block or restrict access to the plugin's lib/files directory and elFinder connector paths at the web server or WAF.
- Scan the wp-content/plugins/wp-file-manager/lib/files/ directory for unexpected .php files and remove any found.
- Rotate WordPress admin credentials and any secrets on hosts that may have been compromised.
Detection
- Monitor web logs for POST requests to wp-file-manager elFinder connector endpoints, especially upload, mkfile or put commands.
- Alert on new .php files appearing under wp-content/plugins/wp-file-manager/lib/files/.
- Hunt for outbound connections or dropped webshells following requests to the plugin's file manager paths.
- Review file integrity monitoring alerts for changes in the plugin directory.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-25213 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "WordPress File Manager Plugin Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-25213 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-25213), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
