CVE-2020-25213: Unauthenticated arbitrary file upload to RCE via the elFinder connector

critical KEV Affects wp-file-manager (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2020-09-09; advisory modified 2026-06-17; listed on CISA KEV 2021-11-03.

Unauthenticated arbitrary file upload to RCE via the elFinder connector

Package: wp-file-manager (WordPress plugin) WordPress
Affected versions: <6.9
Fixed in: 6.9
Severity: critical CVSS 10.0
Exploitation: KEV listed by CISA as actively exploited · EPSS 97% (99.9th percentile)
Published: 2020-09-09

References

CWE-434

NVD record wp-file-manager (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-1538 high The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all v same package: wp-file-manager (WordPress plugin)
CVE-2023-6825 critical The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Tr same package: wp-file-manager (WordPress plugin)
CVE-2018-16967 medium There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress vi same package: wp-file-manager (WordPress plugin)
CVE-2024-0761 high The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in a same package: wp-file-manager (WordPress plugin)
CVE-2018-16966 high There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress vi same package: wp-file-manager (WordPress plugin)
CVE-2024-2654 medium The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions same package: wp-file-manager (WordPress plugin)