Critical severity10.0CISA KEVNVD Advisory· Published Sep 9, 2020· Updated Jun 17, 2026
CVE-2020-25213
CVE-2020-25213
Description
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:*Range: <6.9
- WordPress/File Manager (wp-file-manager)description
Patches
Vulnerability mechanics
References
9- plugins.trac.wordpress.org/changeset/2373068nvdPatch
- packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.htmlnvdExploitThird Party AdvisoryVDB Entry
- seravo.com/blog/0-day-vulnerability-in-wp-file-manager/nvdExploitThird Party Advisory
- wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/nvdExploitThird Party Advisory
- hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.htmlnvdBroken LinkThird Party Advisory
- wordpress.org/plugins/wp-file-manager/nvdProductRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
- zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/nvdPress/Media Coverage
News mentions
2- wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress CoreTenable Blog · Jul 20, 2026
- Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress SitesThe Hacker News · Jul 10, 2026