Live › vulnerability › CVE-2020-25213
Go to dashboardThe File Manager (wp-file-manager) WordPress plugin before 6.9 ships an unsafe elFinder connector file renamed to .php, letting remote attackers upload and execute arbitrary PHP code. This flaw was exploited in the wild in August and September 2020 and is on CISA's Known Exploited Vulnerabilities list.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WordPress File Manager Plugin | vendor | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
This page as .md · .json · in your agent: get_signal("CVE-2020-25213")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.