---
id: "CVE-2020-25213"
kind: "vulnerability"
aliases: ["CVE-2020-25213"]
title: "WordPress File Manager Plugin: WordPress File Manager Plugin Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.97328
exploited: true
status: "open"
category: "package"
products: [{"name": "WordPress File Manager Plugin", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "package", "php", "self-hosted", "wordpress", "wp-file-manager"]
not_affected_if: ["plugin-not-installed", "version-6.9-or-later"]
published_at: "2020-09-09T16:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:27+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-25213", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-25213", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25213", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# WordPress File Manager Plugin: WordPress File Manager Plugin Remote Code Execution Vulnerability

The File Manager (wp-file-manager) WordPress plugin before 6.9 ships an unsafe elFinder connector file renamed to .php, letting remote attackers upload and execute arbitrary PHP code. This flaw was exploited in the wild in August and September 2020 and is on CISA's Known Exploited Vulnerabilities list.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WordPress File Manager Plugin affected ? fixed ?

## How to check

Check the installed wp-file-manager plugin version in the WordPress admin plugins page or in wp-content/plugins/wp-file-manager/ headers.
Look for the file wp-content/plugins/wp-file-manager/lib/files/ and any PHP files in it that you do not recognize.

## Fix

Update the File Manager plugin to version 6.9 or later, then remove any unexpected PHP files from wp-content/plugins/wp-file-manager/lib/files/.
Rotate WordPress admin and hosting credentials if the plugin was exposed before patching.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-25213
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-25213
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-25213

## From the sources

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_