🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2020-25213

10.0

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Updated Oct 23, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~30 seconds

CVE-2020-25213 Scanner

CVE-2020-25213 scanner - Unrestricted File Upload vulnerability in File Manager plugin for WordPress

Used 2.5k times · 3.4k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →