WordPress File Manager plugin allows unauthenticated arbitrary code execution
WordPress File Manager plugin contains a critical vulnerability (CVE-2020-25213) enabling unauthenticated remote attackers to upload malicious files and execute arbitrary code; active exploitation confirmed.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2020-25213 as exploited in the wild.
Japan's Information-technology Promotion Agency (IPA) issued an urgent security advisory regarding a critical vulnerability in the WordPress File Manager plugin. The plugin, which provides file upload, deletion, and management capabilities for WordPress sites, contains a flaw that allows unauthenticated remote attackers to upload malicious files and execute arbitrary code on affected servers.
The vulnerability, tracked as CVE-2020-25213, is being actively exploited in the wild according to IPA. The agency strongly urges all users of the File Manager plugin to immediately update to the patched version released by the developer. Given the severity of the flaw and confirmed exploitation activity, this represents a significant risk to WordPress sites running vulnerable versions of the plugin.
Organizations using this plugin should treat this as a critical priority patch. The ability for unauthenticated attackers to achieve arbitrary code execution provides a direct path to full server compromise, potentially leading to data theft, website defacement, malware distribution, or use of the compromised server as a pivot point for further attacks.
Mentioned in this report
Detection guidance
Web Server Spawning Shell After Suspicious PHP Request (Possible WordPress File Manager Webshell)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP-FPM process spawning a command interpreter, consistent with a webshell dropped via exploitation of the WordPress File Manager plugin (CVE-2020-25213). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell Interpreter
id: 5d909faf-964f-51cc-9b60-53f707dd3ad7
status: experimental
description: Detects apache/nginx/php-fpm processes spawning shell or scripting interpreters,
a common indicator of a webshell executed after exploitation of a vulnerable WordPress
plugin such as File Manager (CVE-2020-25213).
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /php-fpm
- /php-fpm7.4
- /php-fpm8.0
- /php-fpm8.1
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
- /curl
- /wget
- /nc
- /ncat
filter:
CommandLine|contains:
- logrotate
- cron
- healthcheck
condition: selection and not filter
falsepositives:
- Legitimate CGI scripts or admin tooling that shell out from the web server process
- Monitoring/healthcheck scripts executed by the web stack
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.t1059
author: Vorant
PHP File Written Into WordPress File Manager Plugin Upload Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of PHP files inside the wp-file-manager plugin's file storage path, consistent with unauthenticated file upload exploitation of CVE-2020-25213 to drop a webshell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Dropped in wp-file-manager Plugin Directory
id: f2b590c9-b155-531b-b8ab-3e0c3c748de1
status: experimental
description: Detects a new PHP file being written into the wp-file-manager plugin's
file storage directories (lib/files or lib/php), which is the exploited upload path
in CVE-2020-25213 allowing unauthenticated arbitrary file upload.
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: wp-content/plugins/wp-file-manager/lib/
TargetFilename|endswith: .php
filter:
Image|endswith:
- /wp-cli
- /composer
condition: selection and not filter
falsepositives:
- Legitimate plugin update or admin-driven file management uploading PHP scripts to
the same path
- WordPress core/plugin updates that re-copy connector PHP files during patching
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant
HTTP Request to Vulnerable WP File Manager Connector Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the wp-file-manager connector.minimal.php endpoint, the vulnerable component exploited unauthenticated in CVE-2020-25213 for arbitrary file upload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Request to WP File Manager Vulnerable Connector Endpoint
id: 0e9318d3-fd2d-5638-ba91-aaff43c44c72
status: experimental
description: Detects HTTP requests targeting the wp-file-manager plugin's connector.minimal.php
path, which is the unauthenticated file-upload endpoint exploited in CVE-2020-25213.
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: wp-file-manager/lib/php/connector.minimal.php
condition: selection
falsepositives:
- Legitimate administrative use of the File Manager plugin by authenticated site editors
- Vulnerability scanners probing for CVE-2020-25213 as part of authorized assessments
level: medium
tags:
- attack.t1190
- attack.t1505.003
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200918.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs