TI-2020-15454 Aliases CVE-2020-25213 GHSA-w774-7g7w-83fx

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote…

CRITICAL 100Exploited in the wildCWE-434Published 2020-09-09 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03

EPSS 0.97328 99th percentileScored 2026-11-07

Public exploit Yes 5 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:filemanagerpro:file_manager:::::free:wordpress::	before 6.9	Vulnerable	File Manager

cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:* Versions before 6.9 Vulnerable ·File Manager

Remediation

No fixed version listed by the sources yet.

Timeline

2021-11-03 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2020-25213
2026-10-03 Alias added: GHSA-w774-7g7w-83fx

References

Exploit 5

Patch 1

https://plugins.trac.wordpress.org/changeset/2373068

Advisory 1

https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Other 2

TI-2026-45010 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution KEVCVSS 3.1CRITICAL 9.8
TI-2016-08118 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… KEVCVSS 3.1CRITICAL 9.8
TI-2026-83466 Predictable staging paths let attackers run code in WordPress Core KEVCVSS 3.1HIGH 8.1
TI-2026-59973 An unauthenticated attacker can make `get_page_template()` page-template resolution… KEVCVSS 3.1HIGH 8.1
TI-2020-09427 The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before… KEVCVSS 3.1HIGH 7.5
TI-2016-08129 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass… CVSS 3.1CRITICAL 9.8

See all 427 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences