vulnwire
10.0crit

CVE-2020-25213KEVin critical feed2 exploits

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because…

Published 6 y ago · modified 4 mo ago · JSON

CVSS
10.0
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
97.3%
percentile 100%
Public exploits
2
Exploit-DB

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
WordPress / File Manager Plugin
CISA name
WordPress File Manager Plugin Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction (EPSS)

97.33% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-51224 WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE · webapps · 2023-04-03
  • EDB-49178 WordPress Plugin Wp-FileManager 6.8 - RCE · webapps · 2020-12-02

CVSS scores

Assigned byVersionScoreVector
CNA3.110.0CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
CNA3.110.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

  • wordpress.org /plugins/wp-file-manager/#developers · x_transferred
  • github.com /w4fz5uck5/wp-file-manager-0day · x_transferred
  • hotforsecurity.bitdefender.com /blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html · x_transferred
  • wordfence.com /blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-pl · x_transferred
  • plugins.trac.wordpress.org /changeset/2373068 · x_transferred
  • zdnet.com /article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/ · x_transferred
  • seravo.com /blog/0-day-vulnerability-in-wp-file-manager/ · x_transferred
  • packetstormsecurity.com /files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html · x_transferred
  • packetstormsecurity.com /files/171650/WordPress-File-Manager-6.9-Shell-Upload.html · x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.