CVE-2020-25213

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

• CWE-434
• CWE-434

• http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/w4fz5uck5/wp-file-manager-0dayExploit, Third Party Advisory
• https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.htmlBroken Link, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2373068Patch
• https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/Exploit, Third Party Advisory
• https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/Exploit, Third Party Advisory
• https://wordpress.org/plugins/wp-file-manager/#developersProduct, Release Notes
• https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/Press/Media Coverage
• http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/w4fz5uck5/wp-file-manager-0dayExploit, Third Party Advisory
• https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.htmlBroken Link, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2373068Patch
• https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/Exploit, Third Party Advisory
• https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/Exploit, Third Party Advisory
• https://wordpress.org/plugins/wp-file-manager/#developersProduct, Release Notes
• https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/Press/Media Coverage
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213US Government Resource

Published

Sep 9, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25208In JetBrains YouTrack before 2020.4.4701, an attacker could …5.3
• CVE-2020-25209In JetBrains YouTrack before 2020.3.6638, improper access co…7.5
• CVE-2020-2521Rejected reason: This candidate was issued in error.
• CVE-2020-25210In JetBrains YouTrack before 2020.3.7955, an attacker could …5.3
• CVE-2020-25211In the Linux kernel through 5.8.7, local attackers able to i…6
• CVE-2020-25212A TOCTOU mismatch in the NFS client code in the Linux kernel…7
• CVE-2020-25214In the client in Overwolf 0.149.2.30, a channel can be acces…8.1
• CVE-2020-25215yWorks yEd Desktop before 3.20.1 allows XXE attacks via an X…9.8
• CVE-2020-25216yWorks yEd Desktop before 3.20.1 allows code execution via a…9.8
• CVE-2020-25217Grandstream GRP261x VoIP phone running firmware version 1.0.…7.2
• CVE-2020-25218Grandstream GRP261x VoIP phone running firmware version 1.0.…9.8
• CVE-2020-25219url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 al…7.5