Critical · published September 9, 2020
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A sneaky filename trick is a gateway for total chaos! An attacker can execute arbitrary PHP code just by renaming an unsafe connector file in the WP File Manager. 🔥 Think of it like a contractor sneaking in a bogus blueprint and using it to build a hidden room in your house — one that the owners never wanted. In this case, the directory becomes a playground for attackers to create and execute malicious scripts undetected. This vulnerability could allow a remote attacker to upload and execute any PHP code they desire, which means they could take control of your website, steal sensitive data, or even bring your whole site down. The potential for damage is absolutely devastating!
Think of it like a contractor sneaking in a bogus blueprint and using it to build a hidden room in your house — one that the owners never wanted. In this case, the directory becomes a playground for attackers to create and execute malicious scripts undetected. The flaw arises from the wp-file-manager plugin, which carelessly renames an insecure example file to have a .php extension, allowing attackers to use commands like elFinder uploads to write their malicious scripts into the wp-content/plugins/wp-file-manager/lib/files/ directory.
This vulnerability could allow a remote attacker to upload and execute any PHP code they desire, which means they could take control of your website, steal sensitive data, or even bring your whole site down. The potential for damage is absolutely devastating! Immediate action is required! Update the wp-file-manager plugin to version 6.9 or later, and consider removing any unnecessary plugins that could amplify the risk. Additionally, perform a thorough security audit of your site to ensure no malicious files have been uploaded. You've got this! Follow these steps to keep your website safe and sound. 🛡️