A file manager plugin with about 700,000 installations allowed unauthenticated file upload and code execution. A classic lesson about risky plugins.
Publicly disclosed: 1 September 2020
WP File Manager lets administrators manage server files from the WordPress dashboard. In September 2020 attackers were already exploiting a flaw that allowed anyone — without logging in — to upload a PHP file and run it on the server. The cause: a component of the library it used was left reachable in the plugin's folder.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2020-25213 | Critical, CVSS 9.8 (unauthenticated file upload, remote code execution) | WP File Manager 6.0 – 6.8 | 6.9 and later |
Plugins that give file or database access from the browser are especially risky: install them only when really needed and remove them afterwards.
Sources: Wordfence, NVD CVE-2020-25213.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
