{"id":"CVE-2020-25213","kind":"vulnerability","aliases":["CVE-2020-25213"],"related":[],"title":"WordPress File Manager Plugin: WordPress File Manager Plugin Remote Code Execution Vulnerability","description":"The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.","summary":"The File Manager (wp-file-manager) WordPress plugin before 6.9 ships an unsafe elFinder connector file renamed to .php, letting remote attackers upload and execute arbitrary PHP code. This flaw was exploited in the wild in August and September 2020 and is on CISA's Known Exploited Vulnerabilities list.","severity":"critical","cvss":10.0,"epss":0.97328,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"WordPress File Manager Plugin","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","php","self-hosted","wordpress","wp-file-manager"],"not_affected_if":["plugin-not-installed","version-6.9-or-later"],"how_to_check":"Check the installed wp-file-manager plugin version in the WordPress admin plugins page or in wp-content/plugins/wp-file-manager/ headers.\nLook for the file wp-content/plugins/wp-file-manager/lib/files/ and any PHP files in it that you do not recognize.","fix":"Update the File Manager plugin to version 6.9 or later, then remove any unexpected PHP files from wp-content/plugins/wp-file-manager/lib/files/.\nRotate WordPress admin and hosting credentials if the plugin was exposed before patching.","status":"open","published_at":"2020-09-09T16:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:27+00:00","updated_at":"2026-10-23T20:29:27+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-23T20:29:27Z","model":"claude-haiku-5-5","output":{"fix":"Update the File Manager plugin to version 6.9 or later, then remove any unexpected PHP files from wp-content/plugins/wp-file-manager/lib/files/.\nRotate WordPress admin and hosting credentials if the plugin was exposed before patching.","summary":"The File Manager (wp-file-manager) WordPress plugin before 6.9 ships an unsafe elFinder connector file renamed to .php, letting remote attackers upload and execute arbitrary PHP code. This flaw was exploited in the wild in August and September 2020 and is on CISA's Known Exploited Vulnerabilities list.","category":"package","who_cares":["wordpress","wp-file-manager","self-hosted","php"],"confidence":0.9,"analyst_note":"Confirm the fixed version boundary and any IOCs from the NVD and CISA KEV pages (https://nvd.nist.gov/vuln/detail/CVE-2020-25213); the sources here do not list the affected version range precisely.","how_to_check":"Check the installed wp-file-manager plugin version in the WordPress admin plugins page or in wp-content/plugins/wp-file-manager/ headers.\nLook for the file wp-content/plugins/wp-file-manager/lib/files/ and any PHP files in it that you do not recognize.\nunknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-6.9-or-later"],"severity_if_unknown":"critical"},"cost_usd":0.000472,"input_tokens":2193,"output_tokens":505,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2020':14A,17A '-25213':15A,18A '/plugins/wp-file-manager/lib/files':144C '2020':74B,156C '6.9':44B,93C 'allow':96C,123C 'arbitrari':60B,103C 'attack':56B,98C,124C 'august':71B,153C 'cisa':78B 'code':10A,62B,105C,138C 'command':134C 'connector':49B,113C 'content':143C 'cve':13A,16A 'directori':145C 'elfind':48B,112C,128C 'exampl':111C,122C 'execut':11A,59B,102C 'exploit':23B,66B,81B,148C 'extens':119C 'file':2A,6A,20A,32B,35B,39B,50B,85C,89C,114C 'flaw':64B 'host':28B 'known':80B 'let':54B 'list':83B 'manag':3A,7A,33B,36B,40B,86C,90C 'manager':21A 'mkfile':131C 'packag':24B 'php':25B,53B,61B,104C,118C,137C 'plugin':4A,8A,22A,42B,91C 'put':133C 'remot':9A,55B,97C 'renam':51B,108C 'run':126C 'self':27B 'self-host':26B 'septemb':73B,155C 'ship':45B 'unsaf':47B,110C 'upload':57B,100C,129C 'vulner':12A,82B 'wild':69B,151C 'wordpress':1A,5A,19A,29B,41B,95C 'wp':31B,38B,88C,142C 'wp-content':141C 'wp-file-manag':30B,37B,87C 'write':136C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-09-09T16:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-25213","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-25213","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:18+00:00","note":null},{"source":"epss","external_id":"CVE-2020-25213","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-25213","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-25213","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25213","severity":null,"published_at":"2020-09-09T16:15:12+00:00","modified_at":"2026-06-17T03:06:35+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}