CVE-2020-25213

critical-risk
Published 2020-09-09

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Do I need to act?

!
94.4% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
2 public exploits available
49178, 51224
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Filemanagerpro

References (19)

Exploit http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Co...
Exploit http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upl...
Exploit https://github.com/w4fz5uck5/wp-file-manager-0day
Broken Link https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file...
Patch https://plugins.trac.wordpress.org/changeset/2373068
Exploit https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
Exploit https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-v...
Product https://wordpress.org/plugins/wp-file-manager/#developers
Press/Media Coverage https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-...
Exploit http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Co...
Exploit http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upl...
Exploit https://github.com/w4fz5uck5/wp-file-manager-0day
Broken Link https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file...
Patch https://plugins.trac.wordpress.org/changeset/2373068
Exploit https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
Exploit https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-v...
Product https://wordpress.org/plugins/wp-file-manager/#developers
Press/Media Coverage https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-...
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-...
72
/ 100
critical-risk
Severity 33/34 · Critical
Exploitability 34/34 · Critical
Exposure 5/34 · Minimal