CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
Description
CVE-2020-25213 is a critical remote code execution vulnerability in the WordPress File Manager plugin (wp-file-manager) before version 6.9. The plugin renames an unsafe example elFinder connector file to have the .php extension, allowing unauthenticated remote attackers to upload and execute arbitrary PHP code on the target WordPress site. This CVE-2020-25213 vulnerability was actively exploited in the wild during August and September 2020, affecting over 700,000 WordPress installations. With a maximum CVSS score of 10.0 (CRITICAL) and an EPSS score of 94.40% (99.98th percentile), this unrestricted file upload vulnerability represents one of the most severe WordPress plugin flaws ever discovered.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| filemanagerpro | file manager | < 6.9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/w4fz5uck5/wp-file-manager-0day(Exploit, Third Party Advisory)
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html(Broken Link, Third Party Advisory)
- https://plugins.trac.wordpress.org/changeset/2373068(Patch)
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/(Exploit, Third Party Advisory)
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/(Exploit, Third Party Advisory)
- https://wordpress.org/plugins/wp-file-manager/#developers(Product, Release Notes)
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/(Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
The WordPress File Manager plugin exposes an elFinder connector file that allows unauthenticated users to upload files of any type, including PHP scripts, without any validation or restriction. This unrestricted file upload vulnerability enables attackers to deploy web shells and execute arbitrary code on the server, achieving complete system compromise through the WordPress File Manager plugin.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2020-25213 has a CVSS 3.1 score of 9.8 (CRITICAL) from NVD and a perfect 10.0 from the secondary assessment, reflecting the maximum severity of this vulnerability. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any attacker with network access to the WordPress site. Confidentiality (High): attackers can read all files on the server, including database credentials and sensitive WordPress configuration. Integrity (High): arbitrary PHP file upload allows complete modification of website content and server files. Availability (High): attackers can disrupt or destroy the entire WordPress installation. The EPSS score of 94.40% (99.98th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities in existence.
Exploit Maturity
CVE-2020-25213 has extensive public exploit availability and confirmed active exploitation. Public exploit code is available via Packet Storm Security as well as a shell upload variant and a dedicated GitHub repository. CISA has confirmed active exploitation in the wild by including this vulnerability in the Known Exploited Vulnerabilities catalog. The EPSS score of 94.40% (99.98th percentile) indicates near-certain exploitation, which aligns with reports that this zero-day was mass-exploited within hours of public disclosure in August 2020, affecting hundreds of thousands of WordPress sites.
Remediation
- Apply updates immediately as mandated by CISA KEV: Update the WordPress File Manager plugin to version 6.9 or later, which removes the vulnerable elFinder connector file.
- Verify all WordPress File Manager plugin installations are updated. For sites running versions before 6.9, check the
wp-content/plugins/wp-file-manager/lib/files/directory for any uploaded web shells or suspicious PHP files and remove them. - If the plugin is not actively needed, deactivate and delete the WordPress File Manager plugin entirely to eliminate the attack surface. Consider using WordPress’s built-in media library or SFTP-based file management instead.
- Conduct a thorough compromise assessment: review web server access logs for requests to the elFinder connector, search for backdoors or web shells in the WordPress installation, and check for unauthorized admin accounts or modified WordPress core files.
- Implement a Web Application Firewall (WAF) with rules to block file upload attempts to known vulnerable endpoints. Restrict execution permissions on the uploads directory and ensure that uploaded files cannot be executed as PHP scripts.
Technical Details
CVE-2020-25213 exploits an unrestricted file upload vulnerability (CWE-434) in the WordPress File Manager plugin. The plugin includes the elFinder library, a web-based file manager, and ships with an example connector file that was renamed to have a .php extension, inadvertently making it executable. This connector exposes the elFinder upload, mkfile, and put commands without any authentication, allowing remote attackers to write arbitrary PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that no privileges and no user interaction are required, making this a trivially exploitable vulnerability. Once a PHP web shell is uploaded, attackers gain full command execution on the underlying server with the privileges of the web server process.
Frequently Asked Questions
Is CVE-2020-25213 being actively exploited?
Yes. CVE-2020-25213 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. This vulnerability was mass-exploited as a zero-day in August and September 2020. The EPSS score of 94.40% (99.98th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2020-25213?
CVE-2020-25213 affects the WordPress File Manager plugin (wp-file-manager) in all versions before 6.9. This includes both the free and potentially the pro versions of the plugin. At the time of disclosure, over 700,000 WordPress installations were using the affected plugin.
How do I fix CVE-2020-25213?
Update the WordPress File Manager plugin to version 6.9 or later immediately. After updating, inspect the wp-content/plugins/wp-file-manager/lib/files/ directory for any uploaded malicious files. If the plugin is not essential, consider removing it entirely. See the Remediation section for detailed steps.
How severe is CVE-2020-25213?
CVE-2020-25213 has a CVSS 3.1 score of 9.8–10.0 (CRITICAL), the maximum possible severity. The vulnerability requires no authentication and allows complete remote code execution. With an EPSS score in the 99.98th percentile, it is among the most exploited vulnerabilities globally.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.