The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension
Published Sep 9, 2020 ·Due May 3, 2022
10.0
CRITICALCVSS 3.1
EPSS 97.33%
Description
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
Affected products
No data.
- < 6.9
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1 other source (MITRE) ▾
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Date Added
Nov 3, 2021
Patch Due
May 3, 2022
Required Action
Apply updates per vendor instructions.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
YesTechnical Impact
TotalDecision
n/aAssessed Feb 4, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (31 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 97.33% (0.97328) | 99.90th | v5 (v2026.06.15) |
| Jun 15, 2026 | 97.33% (0.97328) | 99.89th | v5 (v2026.06.15) |
| Mar 17, 2025 | 94.40% (0.94401) | 99.97th | v4 (v2025.03.14) |
| Dec 12, 2024 | 97.47% (0.97472) | 99.97th | v3 (v2023.03.01) |
| Jul 14, 2024 | 97.38% (0.97377) | 99.91th | v3 (v2023.03.01) |
| Mar 1, 2024 | 97.39% (0.97395) | 99.91th | v3 (v2023.03.01) |
| Feb 13, 2024 | 97.38% (0.97380) | 99.90th | v3 (v2023.03.01) |
| Feb 7, 2024 | 97.36% (0.97365) | 99.88th | v3 (v2023.03.01) |
| Dec 27, 2023 | 97.38% (0.97381) | 99.90th | v3 (v2023.03.01) |
| Nov 27, 2023 | 97.34% (0.97336) | 99.87th | v3 (v2023.03.01) |
| Nov 11, 2023 | 97.38% (0.97377) | 99.89th | v3 (v2023.03.01) |
| Oct 13, 2023 | 97.35% (0.97352) | 99.86th | v3 (v2023.03.01) |
| Sep 22, 2023 | 97.36% (0.97359) | 99.85th | v3 (v2023.03.01) |
| Aug 29, 2023 | 97.34% (0.97341) | 99.83th | v3 (v2023.03.01) |
| Aug 16, 2023 | 97.39% (0.97385) | 99.86th | v3 (v2023.03.01) |
| Jul 19, 2023 | 97.37% (0.97374) | 99.84th | v3 (v2023.03.01) |
| Jul 8, 2023 | 97.39% (0.97390) | 99.86th | v3 (v2023.03.01) |
| Jul 6, 2023 | 97.48% (0.97483) | 99.94th | v3 (v2023.03.01) |
| May 26, 2023 | 97.49% (0.97489) | 99.95th | v3 (v2023.03.01) |
| May 13, 2023 | 97.50% (0.97500) | 99.95th | v3 (v2023.03.01) |
| May 8, 2023 | 97.48% (0.97482) | 99.94th | v3 (v2023.03.01) |
| Apr 16, 2023 | 97.42% (0.97418) | 99.87th | v3 (v2023.03.01) |
| Mar 8, 2023 | 97.39% (0.97387) | 99.81th | v3 (v2023.03.01) |
| Mar 7, 2023 | 97.40% (0.97399) | 99.83th | v3 (v2023.03.01) |
| Mar 6, 2023 | 95.72% (0.95720) | 99.98th | v2 (v2022.01.01) |
| Feb 4, 2022 | 95.72% (0.95720) | 99.98th | v2 (v2022.01.01) |
| Feb 3, 2022 | 44.22% (0.44221) | 98.85th | v1 |
| Sep 16, 2021 | 44.22% (0.44221) | 99.47th | v1 |
| Sep 14, 2021 | 9.69% (0.09690) | 95.00th | v1 |
| Sep 1, 2021 | 44.22% (0.44221) | 99.47th | v1 |
| Apr 14, 2021 | 44.22% (0.44221) | 0.00th | v1 |
References (10)
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html ExploitThird Party AdvisoryVDB Entry
- https://github.com/w4fz5uck5/wp-file-manager-0day ExploitThird Party Advisory
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html Broken LinkThird Party Advisory
- https://plugins.trac.wordpress.org/changeset/2373068 Patch
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/ ExploitThird Party Advisory
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/ ExploitThird Party Advisory
- https://wordpress.org/plugins/wp-file-manager/#developers ProductRelease Notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213 government-resourceUS Government Resource
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/ Press/Media Coverage
Change history (0)
No recorded changes yet.