CVE-2020-25213
CISA KEVAs of 2025-10-21, CVE-2020-25213 is a CVSS 10 (CRITICAL-severity) vulnerability. CISA KEV-listed (known exploited); Public exploit code available; Nuclei detection template exists. EPSS exploitation probability 97.3%. Threadlinqs Intelligence tracks 2 threats exploiting it.
Last updated: 2025-10-21
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
CVSS v3 vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Weaknesses (CWE)
CWE-434
Exploitation status
CISA KEV-listed (known exploited) · public exploit code available · nuclei detection template exists
- mansoorr123/wp-file-manager-CVE-2020-25213 (github)
- BLY-Coder/Python-exploit-CVE-2020-25213 (github)
- E1tex/Python-CVE-2020-25213 (github)
- kakamband/WPKiller (github)
- forse01/CVE-2020-25213-Wordpress (github)
- 0000000O0Oo/Wordpress-CVE-2020-25213 (github)
- piruprohacking/CVE-2020-25213 (github)
- b1ackros337/CVE-2020-25213 (github)
Threats tracking this CVE
- WP-SHELLSTORM: Exposed Chinese-Speaking Threat Actor Server Reveals Mass WordPress/Joomla Webshell Brokerage Targeting 1.4M Domains via CVE-2026-48907 (Joomla JCE) and CVE-2021-29441 (Nacos) — HIGH
- ErrTraffic: ClickFix Malware-as-a-Service Distribution Framework Delivering Infostealers and Loaders via Compromised WordPress and EtherHiding Polygon C2 — HIGH
References
- https://wordpress.org/plugins/wp-file-manager/#developers
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
- https://plugins.trac.wordpress.org/changeset/2373068
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
← all vulnerabilities · Markdown version · Threadlinqs Intelligence
Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.