CVE-2020-25213
📋 TL;DR
This vulnerability allows remote attackers to upload and execute arbitrary PHP code on WordPress sites using the vulnerable wp-file-manager plugin. Attackers can achieve full remote code execution by exploiting an unsafe example file that gets renamed with a .php extension. All WordPress sites running affected versions of the wp-file-manager plugin are vulnerable.
💻 Affected Systems
- WordPress wp-file-manager plugin
📦 What is this software?
File Manager by Filemanagerpro
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary commands, install backdoors, steal data, deface websites, and pivot to other systems.
Likely Case
Attackers upload web shells to gain persistent access, deploy malware, steal sensitive data, and use compromised sites for further attacks.
If Mitigated
With proper web application firewalls and file integrity monitoring, exploitation attempts are blocked and detected before successful compromise.
🎯 Exploit Status
This vulnerability was actively exploited in the wild in August-September 2020. Multiple public exploit scripts and proof-of-concepts are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.9 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2373068
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find wp-file-manager plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete the plugin immediately.
🔧 Temporary Workarounds
Delete vulnerable connector file
linuxRemove the vulnerable example connector file that gets renamed to .php extension
rm -f /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php-dist
rm -f /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php
Disable plugin via wp-cli
allDeactivate the vulnerable plugin using WordPress command-line interface
wp plugin deactivate wp-file-manager
🧯 If You Can't Patch
- Immediately deactivate and remove the wp-file-manager plugin from all WordPress installations
- Implement web application firewall rules to block requests to /wp-content/plugins/wp-file-manager/lib/php/ paths
🔍 How to Verify
Check if Vulnerable:
Check if file exists: /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php or connector.minimal.php-distCheck Version:
wp plugin get wp-file-manager --field=versionVerify Fix Applied:
Verify plugin version is 6.9 or higher in WordPress admin panel and ensure vulnerable files are removed📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php
- File uploads to wp-content/plugins/wp-file-manager/lib/files/ directory
- Creation of suspicious PHP files in plugin directories
Network Indicators:
- Unusual outbound connections from WordPress server
- Traffic patterns matching known exploit payloads
SIEM Query:
source="web_access_logs" AND (uri_path="/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php" OR uri_path CONTAINS "/wp-file-manager/lib/files/")🔗 References
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
- https://plugins.trac.wordpress.org/changeset/2373068
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
- https://wordpress.org/plugins/wp-file-manager/#developers
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
- https://plugins.trac.wordpress.org/changeset/2373068
- https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
- https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
- https://wordpress.org/plugins/wp-file-manager/#developers
- https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213
