10.0Critical KEV

CVE-2020-25213WordPress File Manager Plugin Remote Code Execution Vulnerability

filemanagerpro file manager Published: 2020-09-09 03:00 (6 years ago)

Known exploited — WordPress File Manager Plugin Remote Code Execution Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-25213

Description

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Weakness (CWE): CWE-434

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
filemanagerpro	file manager	< 6.9

References and patches

https://wordpress.org/plugins/wp-file-manager/#developers ProductRelease Notes
https://github.com/w4fz5uck5/wp-file-manager-0day ExploitThird Party Advisory
https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability… Broken LinkThird Party Advisory
https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-… ExploitThird Party Advisory
https://plugins.trac.wordpress.org/changeset/2373068 Patch
https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/ Press/Media Coverage
https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/ ExploitThird Party Advisory
http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213 US Government Resource

CPE matches (NVD) (1)

cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:* < 6.9

CVSS score

10.0Critical

Source: mitre · CVSS 3.1

Attack complexity: Low
Attack vector: Network
Availability: High
Confidentiality: High
Integrity: High
Privileges required: None
Scope: Changed
User interaction: None

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

All scores (4)

cna	CVSS 3.1	10.0Critical
cve@mitre.org	CVSS 3.1	10.0Critical
nvd	CVSS 3.1	9.8Critical
nvd	CVSS 2.0	7.5High

EPSS (chance of exploitation in 30 days)

97.33%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: total

Timeline

ID reserved2020-09-09
Published2020-09-09 03:00
Reached IP-DB2026-10-24 23:35
Added to KEV2021-11-03
Last updated2026-06-17 06:06

Assigned by (CNA): mitre
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

6.5Medium

CVE-2026-121794 1 hour ago

Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen

magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an actio…

6.4Medium

CVE-2026-122222 1 hour ago

Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug

mbis Permalink Manager Lite

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authentica…

7.2High

CVE-2026-110291 1 hour ago

Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings

iqonicdesign Graphina – Charts and Graphs For Elementor

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node_font_family (and any text control serialized into chart_data['settings'])' parameter in all versions up to, and includ…

6.4Medium

CVE-2026-118189 1 hour ago

Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

barn2media Posts Table with Search & Sort

The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possibl…

6.4Medium

CVE-2026-120671 1 hour ago

UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute

stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient …

6.5Medium

CVE-2026-119472 1 hour ago

WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability

David Anderson Redux Framework

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.