CVE-2020-25213

The File Manager (wp-file-manager) WordPress plugin before version 6.9 ships an example elFinder connector file that the plugin renames to have a .php extension, exposing it directly to unauthenticated web requests. An attacker can invoke the elFinder upload (or mkfile and put) commands on that connector to write arbitrary PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory, which the web server then executes. Successful exploitation yields full unauthenticated remote code execution on the hosting server, compromising the WordPress site and potentially the broader host. Any WordPress site running an affected version of the File Manager plugin is exposed, and the flaw was heavily exploited in the wild in August and September 2020, including mass backdooring campaigns (WP-SHELLSTORM) and chaining with other vulnerabilities such as Zerologon. It carries a CVSS 3.1 score of 9.8, sits in CISA's Known Exploited Vulnerabilities catalog, and has a 97.3% EPSS probability of exploitation.

What to do: Update the File Manager (wp-file-manager) plugin to version 6.9 or later immediately, per vendor and CISA instructions. If updating is not immediately possible, deactivate the plugin or remove/restrict the exposed example elFinder connector file, and check wp-content/plugins/wp-file-manager/lib/files/ for unexpected PHP files (e.g., webshells) plus unfamiliar admin users, since exploitation was widespread in August–September 2020.