CVE DatabaseCVE-2020-25213

Updated 2026-06-17한국어 권고문 →

CVE-2020-252139.8/CRITICALCISA KEVCWE-434CWE-434

WordPress File Manager Plugin Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2020-25213)

⚡ Jump to Patch

Affected Vendors

wordpress, mndpsingh287

Affected Components

wp-file-manager

Published Date

2020-09-09

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

97.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

WordPress File Manager (wp-file-manager) plugin versions 6.0 through 6.8

Impact

Unauthenticated remote attackers can upload and execute arbitrary PHP code, leading to complete compromise of the underlying web server

Mitigation

Immediately update the File Manager plugin to version 6.9 or higher, or completely deactivate and remove the plugin if not required

Affected Products & Version Scope

All WordPress installations running File Manager (wp-file-manager) plugin versions 6.0 up to 6.8 (Patched in 6.9)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Use the WordPress Command Line Interface (WP-CLI) to immediately upgrade the vulnerable plugin to the patched version.

bash

# Navigate to WordPress root and update the plugin
wp plugin update wp-file-manager --allow-root

# Verify that the active version is 6.9 or higher
wp plugin list --field=name,version,status | grep wp-file-manager

2. Temporary Workaround & Hardening Configuration

If an immediate update is not feasible, block all external access to the vulnerable elFinder connector files using web server configuration rules.

nginx

# Add to your Nginx server block to block direct access to the connector
location ~* /wp-content/plugins/wp-file-manager/lib/php/connector.*\.php$ {
    deny all;
    return 403;
}

3. Log Audit & IoC Verification Commands

Run the following commands to check for the presence of the vulnerable file and scan for potential indicators of compromise (IoCs).

bash

# 1. Locate the vulnerable connector file on the system
find . -path '*/wp-file-manager/lib/php/connector.minimal.php' -print

# 2. Scan the default upload directory for unauthorized PHP files
find ./wp-content/plugins/wp-file-manager/lib/files/ -name '*.php' -type f

# 3. Search web server access logs for exploitation attempts targeting the connector
grep -E 'connector\.(minimal|php)' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

To secure your environment, immediately remove unused plugins and configure Web Application Firewall (WAF) rules to block unauthorized elFinder connector requests.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-25213) is a critical Remote Code Execution (RCE) flaw in the 'File Manager (wp-file-manager)' plugin for WordPress. The root cause lies in the insecure inclusion of 'elFinder', an open-source file management library. The plugin shipped with an unsafe example connector file (connector.minimal.php-dist) renamed to a executable .php extension within the production environment. This exposure allows unauthenticated external actors to directly access the connector and invoke elFinder backend APIs without any authentication.

2. Exploitation Mechanics & Attack Scenario

An attacker can send direct HTTP POST requests to the exposed connector at wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php. Because the connector does not validate session privileges, the attacker can leverage elFinder's native file manipulation commands such as upload, mkfile, or put. By executing these commands, the attacker uploads a malicious PHP web shell into the wp-content/plugins/wp-file-manager/lib/files/ directory and subsequently requests the uploaded file to execute arbitrary system commands.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and active exploitation observed in the wild, this vulnerability poses an extreme risk to infrastructure. Successful exploitation grants the attacker the execution privileges of the web server daemon (e.g., www-data). This can lead to database credential theft, website defacement, deployment of ransomware, lateral movement within the internal network, and full host takeover.

Official Vendor Advisories & References

NVD Original English Description

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

https://github.com/w4fz5uck5/wp-file-manager-0day

Source: cve@mitre.org · Exploit, Third Party Advisory

https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Source: cve@mitre.org · Broken Link, Third Party Advisory

https://plugins.trac.wordpress.org/changeset/2373068

Source: cve@mitre.org · Patch

https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/

Source: cve@mitre.org · Exploit, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2020-25213)

FAQ

Q1. How critical is CVE-2020-25213 and is it actively exploited in the wild?

CVE-2020-25213 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 97.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-25213?

Primary impacted vendors include wordpress, mndpsingh287 across wp-file-manager. Scope summary: All WordPress installations running File Manager (wp-file-manager) plugin versions 6.0 up to 6.8 (Patched in 6.9)

Q3. What temporary mitigations or workarounds exist for CVE-2020-25213 before patching?

[Mitigation] Immediately update the File Manager plugin to version 6.9 or higher, or completely deactivate and remove the plugin if not required Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION