10.0Kritik KEV

CVE-2020-25213WordPress File Manager Plugin Remote Code Execution Vulnerability

filemanagerpro file manager Yayım: 2020-09-09 03:00 (6 yıl önce)

Aktif olarak istismar ediliyor — WordPress File Manager Plugin Remote Code Execution Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 03.11.2021 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 03.05.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-25213

Açıklama

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Zayıflık türü (CWE): CWE-434

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
filemanagerpro	file manager	< 6.9

Kaynaklar ve yamalar

https://wordpress.org/plugins/wp-file-manager/#developers ProductRelease Notes
https://github.com/w4fz5uck5/wp-file-manager-0day ExploitThird Party Advisory
https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability… Broken LinkThird Party Advisory
https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-… ExploitThird Party Advisory
https://plugins.trac.wordpress.org/changeset/2373068 Patch
https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/ Press/Media Coverage
https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/ ExploitThird Party Advisory
http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213 US Government Resource

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:* < 6.9

CVSS puanı

10.0Kritik

Kaynak: mitre · CVSS 3.1

Karmaşıklık: Düşük
Saldırı yolu: Ağ
Erişilebilirlik: Yüksek
Gizlilik: Yüksek
Bütünlük: Yüksek
Gereken yetki: Yok
Kapsam: Değişir
Kullanıcı etkileşimi: Gerekmez

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Tüm puanlar (4)

cna	CVSS 3.1	10.0Kritik
cve@mitre.org	CVSS 3.1	10.0Kritik
nvd	CVSS 3.1	9.8Kritik
nvd	CVSS 2.0	7.5Yüksek

EPSS (30 günde istismar olasılığı)

97.33%

tüm CVE'lerin %100'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2020-09-09
Yayımlandı2020-09-09 03:00
IP-DB'ye ulaştı2026-10-24 23:35
KEV'e eklendi2021-11-03
Son güncelleme2026-06-17 06:06

Numarayı veren (CNA): mitre
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

9.8Kritik

CVE-2026-86596 5 saat önce

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…

9.8Kritik

CVE-2026-102435 7 saat önce

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

themefic Ultra Addons for Contact Form 7

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated att…

5.3Orta

CVE-2026-103310 19 saat önce

PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

PayHere Payment Gateway

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation a…

6.5Orta

CVE-2026-119480 dün

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

Crocoblock JetFormBuilder

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

9.3Kritik

CVE-2026-62048 dün

WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Liquid Web / StellarWP BookIt

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

7.1Yüksek

CVE-2026-66570 dün

WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Nickboss WordPress File Upload

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.