WordPress File Manager Plugin Remote Code Execution Vulnerability

CheckOps priority index

9.3/10 Patch within 24 h

Severity10.0

Probability9.7

Exploitation4/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 97.3% higher than 99.9% of CVEs

CVSS 3.1 10.0 AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C

Exploited for 1,826 days 03 Nov 2021

CISA due date 03 May 2022 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 4 / 5

KEV catalog (CISA)03 Nov 2021
Exploited in EUVD (ENISA)03 Nov 2021
Used by ransomwareno
EPSS above 10 %97.3%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply updates per vendor instructions.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

Affected products

File Manager Plugin

Weaknesses (CWE)

CWE-434

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

09 Sept 2020
Published
03 Nov 2021
Exploitation reported (ENISA)
03 Nov 2021
Added to the KEV catalog
03 May 2022
CISA remediation due date
26 Sept 2026
EPSS peak: 97.3%

References

Other exploited vulnerabilities from the same vendor

CVE-2026-87902WordPress Core Remote File Inclusion Vulnerability
8.5 · Actively exploited
CVE-2026-63030WordPress Core Interpretation Conflict Vulnerability
6.6 · Actively exploited
CVE-2026-60137WordPress Core SQL Injection Vulnerability
4.3 · Actively exploited
CVE-2020-11738WordPress Snap Creek Duplicator Plugin File Download Vulnerability
8.3 · Background exploitation
CVE-2019-9978WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
7.0 · Background exploitation