WordPress File Manager plugin contains a critical vulnerability (CVE-2020-25213) enabling…

17 September 2020 critical vulnerability

WordPress File Manager plugin contains a critical vulnerability (CVE-2020-25213) enabling unauthenticated remote attackers to upload malicious files and execute arbitrary code; active exploitation confirmed.

Japan's Information-technology Promotion Agency (IPA) issued an urgent security advisory regarding a critical vulnerability in the WordPress File Manager plugin. The plugin, which provides file upload, deletion, and management capabilities for WordPress sites, contains a flaw that allows unauthenticated remote attackers to upload malicious files and execute arbitrary code on affected servers.

The vulnerability, tracked as CVE-2020-25213, is being actively exploited in the wild according to IPA. The agency strongly urges all users of the File Manager plugin to immediately update to the patched version released by the developer. Given the severity of the flaw and confirmed exploitation activity, this represents a significant risk to WordPress sites running vulnerable versions of the plugin.

Organizations using this plugin should treat this as a critical priority patch. The ability for unauthenticated attackers to achieve arbitrary code execution provides a direct path to full server compromise, potentially leading to data theft, website defacement, malware distribution, or use of the compromised server as a pivot point for further attacks.

Mentioned in this report

Vulnerabilities CVE-2020-25213KEV

Detection guidance

Web Server Spawning Shell After Suspicious PHP Request (Possible WordPress File Manager Webshell)

ATT&CK T1505.003

Detects a web server or PHP-FPM process spawning a command interpreter, consistent with a webshell dropped via exploitation of the WordPress File Manager plugin (CVE-2020-25213). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell Interpreter
id: 5d909faf-964f-51cc-9b60-53f707dd3ad7
status: experimental
description: Detects apache/nginx/php-fpm processes spawning shell or scripting interpreters,
  a common indicator of a webshell executed after exploitation of a vulnerable WordPress
  plugin such as File Manager (CVE-2020-25213).
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7.4
    - /php-fpm8.0
    - /php-fpm8.1
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /perl
    - /python
    - /python3
    - /curl
    - /wget
    - /nc
    - /ncat
  filter:
    CommandLine|contains:
    - logrotate
    - cron
    - healthcheck
  condition: selection and not filter
falsepositives:
- Legitimate CGI scripts or admin tooling that shell out from the web server process
- Monitoring/healthcheck scripts executed by the web stack
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.t1059
author: Vorant

PHP File Written Into WordPress File Manager Plugin Upload Directory

ATT&CK T1505.003

Detects creation of PHP files inside the wp-file-manager plugin's file storage path, consistent with unauthenticated file upload exploitation of CVE-2020-25213 to drop a webshell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP File Dropped in wp-file-manager Plugin Directory
id: f2b590c9-b155-531b-b8ab-3e0c3c748de1
status: experimental
description: Detects a new PHP file being written into the wp-file-manager plugin's
  file storage directories (lib/files or lib/php), which is the exploited upload path
  in CVE-2020-25213 allowing unauthenticated arbitrary file upload.
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: wp-content/plugins/wp-file-manager/lib/
    TargetFilename|endswith: .php
  filter:
    Image|endswith:
    - /wp-cli
    - /composer
  condition: selection and not filter
falsepositives:
- Legitimate plugin update or admin-driven file management uploading PHP scripts to
  the same path
- WordPress core/plugin updates that re-copy connector PHP files during patching
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

HTTP Request to Vulnerable WP File Manager Connector Endpoint

ATT&CK T1190

Detects HTTP requests to the wp-file-manager connector.minimal.php endpoint, the vulnerable component exploited unauthenticated in CVE-2020-25213 for arbitrary file upload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Request to WP File Manager Vulnerable Connector Endpoint
id: 0e9318d3-fd2d-5638-ba91-aaff43c44c72
status: experimental
description: Detects HTTP requests targeting the wp-file-manager plugin's connector.minimal.php
  path, which is the unauthenticated file-upload endpoint exploited in CVE-2020-25213.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: wp-file-manager/lib/php/connector.minimal.php
  condition: selection
falsepositives:
- Legitimate administrative use of the File Manager plugin by authenticated site editors
- Vulnerability scanners probing for CVE-2020-25213 as part of authorized assessments
level: medium
tags:
- attack.t1190
- attack.t1505.003
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200918.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free