CVE-2020-25213

Deeper analysis

The File Manager (wp-file-manager) plugin before version 6.9 for WordPress contains an arbitrary file upload vulnerability tracked as CVE-2020-25213. The root cause is the plugin's renaming of an unsafe example elFinder connector file to a .php extension, which enables use of elFinder commands such as upload, mkfile, and put to write attacker-controlled PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. The issue is classified under CWE-434 and carries a CVSS 3.1 base score of 10.0.

Unauthenticated remote attackers can exploit the flaw over the network to upload and execute arbitrary PHP, resulting in full compromise of confidentiality, integrity, and availability with scope change to other WordPress components. Public exploit code and Metasploit modules have been available since shortly after disclosure, lowering the barrier for mass compromise of unpatched sites.

The official mitigation is to update the plugin to version 6.9 or later, as reflected in the WordPress plugin repository changeset 2373068 that removed the vulnerable connector file. Multiple public advisories and proof-of-concept reports emphasize that sites remaining on earlier releases remain exposed until the update is applied.

The vulnerability saw active exploitation in the wild during August and September 2020, with observed campaigns leveraging it for website defacement and further malware deployment.