ZeroDay Findings
Sign inSign up

Findings

CVE-2020-25213

WordPress File Manager Plugin Remote Code Execution Vulnerability

Published Sep 9, 2020 · updated Jun 16, 2026 · filemanagerpro file manager

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 9, 2020 · Catalog

    Detected

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe filemanagerpro/file managerversion unspecified
  • vendor WordPress File Manager Pluginversion unspecified

Sources

  • CISA KEVCVE-2020-25213

    WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.

    cisa.gov
  • CVE.orgCVE-2020-25213

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-25213

    30-day exploitation probability 97.3%

    first.org
  • Exploit Database49178

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database51224

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/wp_file_manager_rce

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2020-25213

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upl

    nvd.nist.gov

References