CVE-2020-25213

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to...

10.0 CriticalIn KEVPublic exploit

CVE-2020-25213 is a critical vulnerability (CVSS 10.0) in Filemanagerpro File Manager, published September 9, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.3%, the 99th percentile. No source names a fixed version.

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

97.3%Up 53.1 points since Apr 14, 2021

What each source reports

CVE List Score used 10.0

Record: CVE-2020-25213
CVSS 3.1: 10.0 CriticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Weakness: CWE-434
Updated: 2026-11-02

EUVDEUVD-2020-17903 10.0

Record: EUVD-2020-17903
CVSS 3.1: 10.0 CriticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w774-7g7w-83fx 9.8

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to...

Record: GHSA-w774-7g7w-83fx
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

CISA KEV No score

WordPress File Manager Plugin Remote Code Execution Vulnerability

WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.

Record: CVE-2020-25213
Weakness: CWE-434
Updated: 2026-11-02

NVD 10.0

Record: CVE-2020-25213
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-434
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	WordPress File Manager Unauthenticated Remote Code Execution	2020-09-09
PoC in GitHub	mansoorr123/wp-file-manager-CVE-2020-25213	2020-10-10
PoC in GitHub	kakamband/WPKiller	2020-11-13
Exploit-DB	WordPress Plugin Wp-FileManager 6.8 - RCE	2020-12-02
PoC in GitHub	forse01/CVE-2020-25213-Wordpress	2021-02-04
PoC in GitHub	0000000O0Oo/Wordpress-CVE-2020-25213	2021-03-12
PoC in GitHub	piruprohacking/CVE-2020-25213	2021-04-03
PoC in GitHub	b1ackros337/CVE-2020-25213	2022-05-24
PoC in GitHub	BLY-Coder/Python-exploit-CVE-2020-25213	2023-01-22
Exploit-DB	WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE	2023-04-03

Show 6 moreShow less

Public exploits
Source	Link	Date
PoC in GitHub	E1tex/Python-CVE-2020-25213	2023-08-02
PoC in GitHub	Cmadhushanka/wordpress-rce-vapt-cve-2020-25213	2026-05-09
PoC in GitHub	KienHoSD/wp-file-manager-exploit-CVE-2020-25213-with-Zerologon	2026-05-10
PoC in GitHub	Maalfer/CVE-2020-25213-exploit	2026-10-14
PoC in GitHub	rigby721/CEV-2020-25213_wp-file-manger_exploit	2026-10-25
Nuclei	WordPress File Manager Plugin - Remote Code Execution

History

History
When	Changed	Sources
2026-11-03	exploitation, exploits
2026-11-02	created	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

References

Show 6 moreShow less