CVE-2020-25213: File Manager Pro WordPress RCE Vulnerability

CVE-2020-25213 Overview

CVE-2020-25213 is a critical remote code execution vulnerability affecting the File Manager (wp-file-manager) plugin for WordPress prior to version 6.9. The vulnerability allows unauthenticated remote attackers to upload and execute arbitrary PHP code on affected WordPress installations. This occurs because the plugin renames an unsafe example elFinder connector file to have a .php extension, exposing powerful file manipulation capabilities to unauthenticated users. Attackers can leverage the elFinder upload, mkfile, and put commands to write malicious PHP code directly into the wp-content/plugins/wp-file-manager/lib/files/ directory, achieving full remote code execution on the target server.

Critical Impact

This vulnerability was actively exploited in the wild during August and September 2020, with reports indicating millions of WordPress sites were probed or attacked. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation in real-world attacks.

Affected Products

• File Manager (wp-file-manager) plugin for WordPress versions prior to 6.9
• WordPress installations with vulnerable wp-file-manager plugin installed
• Filemanagerpro File Manager (Free edition for WordPress)

Discovery Timeline

• September 9, 2020 - CVE-2020-25213 published to NVD
• November 7, 2025 - Last updated in NVD database

Technical Details for CVE-2020-25213

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The core issue lies in the improper inclusion of elFinder library connector files within the WordPress plugin distribution. elFinder is a web-based file manager that provides a rich API for file operations. During the plugin's packaging or installation process, a connector example file (connector.minimal.php.dist) was renamed to connector.minimal.php, making it directly accessible without authentication.

The elFinder connector provides powerful file management capabilities including file upload, creation, modification, and deletion. When exposed without proper access controls, these capabilities become a direct pathway to remote code execution. Attackers can craft HTTP requests to the connector endpoint to upload webshells or create new PHP files containing malicious code.

The attack surface is particularly severe because it requires no authentication whatsoever—any network-accessible WordPress site running the vulnerable plugin version is immediately exploitable. Mass exploitation campaigns were documented affecting hundreds of thousands of WordPress sites, with threat actors deploying webshells, cryptocurrency miners, and other malicious payloads.

Root Cause

The root cause of this vulnerability is the improper inclusion and exposure of development/example files in the production plugin release. The elFinder library includes example connector files intended for development and testing purposes, which should never be deployed in production environments. The File Manager plugin inadvertently exposed the connector.minimal.php file (renamed from .dist) without implementing any authentication or authorization checks. This left the powerful elFinder API endpoints accessible to unauthenticated attackers, who could leverage them to upload arbitrary files including malicious PHP scripts.

Attack Vector

The attack is executed over the network without requiring any user interaction or prior authentication. Attackers send specially crafted HTTP POST requests to the exposed elFinder connector endpoint at a predictable path within the WordPress plugin directory. The elFinder API supports multiple commands that can be abused for code execution:

The exploitation flow typically involves:

1. Identifying WordPress installations with the vulnerable File Manager plugin version
2. Sending requests to the wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php endpoint
3. Using the elFinder upload command to upload a PHP webshell, or using mkfile and put commands to create and write content to a new PHP file
4. Accessing the uploaded malicious PHP file to execute arbitrary commands on the server

The attack can be easily automated, which contributed to the widespread exploitation observed in the wild. Detailed technical write-ups and proof-of-concept code are available in public repositories and security advisories such as the Packet Storm RCE Advisory and the Seravo 0-Day Blog Post.

Detection Methods for CVE-2020-25213

Indicators of Compromise

• Presence of unexpected PHP files in wp-content/plugins/wp-file-manager/lib/files/ directory
• HTTP requests to connector.minimal.php in web server access logs, particularly POST requests with elFinder commands
• Suspicious PHP files with obfuscated code, base64-encoded content, or webshell indicators such as eval(), system(), exec(), or passthru() functions
• Unexpected outbound network connections from the web server to unknown IP addresses

Detection Strategies

• Monitor web server access logs for requests targeting /wp-file-manager/lib/php/connector.minimal.php with command parameters
• Implement file integrity monitoring (FIM) on WordPress plugin directories to detect unauthorized file creation or modification
• Deploy web application firewall (WAF) rules to block requests containing elFinder command parameters (cmd=upload, cmd=mkfile, cmd=put) to vulnerable paths
• Scan for known webshell signatures and suspicious PHP patterns in the plugin's files directory

Monitoring Recommendations

• Enable detailed access logging for WordPress installations and regularly review logs for exploitation attempts
• Implement real-time alerting for file creation events in WordPress plugin directories, especially for .php files
• Configure endpoint detection and response (EDR) solutions to monitor web server processes for suspicious child process execution
• Establish baseline behavior for WordPress server processes and alert on anomalous command execution patterns

How to Mitigate CVE-2020-25213

Immediate Actions Required

• Update the File Manager (wp-file-manager) plugin to version 6.9 or later immediately
• If unable to update immediately, deactivate and remove the vulnerable plugin until patching is possible
• Audit the wp-content/plugins/wp-file-manager/lib/files/ directory for any unauthorized or suspicious PHP files
• Review web server access logs for evidence of exploitation attempts and investigate any identified compromises

Patch Information

The vulnerability was addressed in File Manager plugin version 6.9. The patch removes the exposed elFinder connector file and implements proper access controls. The official fix can be reviewed in the WordPress Trac Changeset. WordPress site administrators should update through the WordPress admin dashboard or by downloading the latest version from the WordPress Plugin Directory.

Workarounds

• Delete or rename the connector.minimal.php file located at wp-content/plugins/wp-file-manager/lib/php/ to prevent exploitation
• Implement web server access controls (e.g., .htaccess rules for Apache or location blocks for Nginx) to deny access to the elFinder library directory
• Use a web application firewall (WAF) to block requests to the vulnerable connector endpoint
• Consider uninstalling the plugin entirely if file management functionality is not required

# Apache .htaccess workaround - add to WordPress root or plugin directory
# Block access to elFinder connector files
<FilesMatch "connector\.minimal\.php$">
    Require all denied
</FilesMatch>

# Alternative: Remove the vulnerable file entirely
rm /var/www/html/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php