CVE-2020-25213 WordPress File Manager Plugin Remote Code Execution

Exploited in the wild Critical 10.0 Published 9 Sep 2020 Updated 21 Oct 2025

Remote attackers can upload and execute arbitrary PHP code via the wp-file-manager plugin, leading to full site compromise.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-25213?

CVE-2020-25213 is a critical vulnerability in n/a, published on 9 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Weakness: CWE-434

Which versions are affected by CVE-2020-25213?

It affects 1 product.

Products include Filemanagerpro File Manager.

How do I fix CVE-2020-25213?

No fix has been published for CVE-2020-25213 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Is CVE-2020-25213 being exploited?

Yes. Attackers have exploited CVE-2020-25213 in the wild since at least 3 Nov 2021.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 12 proofs of concept on GitHub.

Sources

Also known as GHSA-w774-7g7w-83fx.