module
WordPress File Manager Unauthenticated Remote Code Execution
| Disclosed |
|---|
| Sep 9, 2020 |
Disclosed
Sep 9, 2020
Description
The File Manager (wp-file-manager) plugin from 6.0 to 6.8 for WordPress allows remote attackers to upload and
execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php
extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write
PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory.
execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php
extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write
PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.