CVE-2020-25213VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-25213: WordPress File Manager Plugin Remote Code Execution Vulnerability

Affects WordPress File Manager PluginSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 97.3% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-25213 (opens in a new tab)

Description

The WordPress File Manager plugin has a remote code execution vulnerability that permits unauthenticated attackers to execute arbitrary PHP code and upload malicious files on affected websites. This vulnerability has been exploited in the wild, posing a significant risk to site integrity and security.

Summary

CVE-2020-25213 identifies a remote code execution vulnerability in the WordPress File Manager plugin. This flaw allows unauthenticated users to upload malicious PHP files and execute arbitrary code on the target WordPress site, potentially leading to full site compromise. The vulnerability is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type). Exploitation has been observed in the wild, indicating active threat actor use.

Impact

Successful exploitation enables attackers to execute arbitrary PHP code remotely without authentication, allowing them to upload malicious files and potentially take full control of the affected WordPress site. This can lead to website defacement, data theft, malware distribution, or further network compromise.

Mitigation

No explicit patch or remediation details are provided in the available data. Users should check the official WordPress plugin repository or vendor advisories for updates or patches addressing CVE-2020-25213. Until a fix is applied, disabling or removing the vulnerable File Manager plugin is recommended to prevent exploitation.

Weaknesses

CWE-434Unrestricted File Upload (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:44 UTC

Weaknesses

References

Related threats