CVE-2020-10564

An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.

• CWE-22

• https://github.com/beerpwn/CVE/tree/master/WP-File-Upload_disclosure_report/Exploit, Third Party Advisory
• https://wordpress.org/plugins/wp-file-upload/#developersRelease Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/10132Third Party Advisory
• https://github.com/beerpwn/CVE/tree/master/WP-File-Upload_disclosure_report/Exploit, Third Party Advisory
• https://wordpress.org/plugins/wp-file-upload/#developersRelease Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/10132Third Party Advisory

Published

Mar 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10558The driving interface of Tesla Model 3 vehicles in any relea…6.5
• CVE-2020-1056An elevation of privilege vulnerability exists when Microsof…8.1
• CVE-2020-10560An issue was discovered in Open Source Social Network (OSSN)…5.9
• CVE-2020-10561An issue was discovered on Xiaomi Mi Jia ink-jet printer < 3…9.8
• CVE-2020-10562An issue was discovered in DEVOME GRR before 3.4.1c. admin_e…7.2
• CVE-2020-10563An issue was discovered in DEVOME GRR before 3.4.1c. frmcont…9.8
• CVE-2020-10565grub2-bhyve, as used in FreeBSD bhyve before revision 525916…7.8
• CVE-2020-10566grub2-bhyve, as used in FreeBSD bhyve before revision 525916…7.8
• CVE-2020-10567An issue was discovered in Responsive Filemanager through 9.…9.8
• CVE-2020-10568The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.…8.8
• CVE-2020-10569SysAid On-Premise 20.1.11, by default, allows the AJP protoc…9.8
• CVE-2020-1057<p>A remote code execution vulnerability exists in the way t…4.2