Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AC AV A C I PR S UI CVSS EPSS %ile KEV L N H H H N C N 10.0 .9733 99.9 YES
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Sep 9 Reserved by mitre Sep 9 Published (CNA: mitre) Nov 3 Added to CISA KEV, remediation due 2022-05-03
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.
| Date | Event | Detail |
|---|---|---|
| September 9, 2020 | Reserved | Reserved by mitre |
| September 9, 2020 | Published | Published (CNA: mitre) |
| November 3, 2021 | KEV ADDED | Added to CISA KEV, remediation due 2022-05-03 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | n/a | — | n/a | — |
Authoritative record: CVE-2020-25213 at cve.org
Weaknesses: CWE-434
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-25213 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
