CVE-2020-35235

vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control

published December 14, 2020

CVSS

—

EPSS

18%

Percentile

97.2

In the wild

Unconfirmed

What it is

vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.18284 · 97.2th percentile
Published: 2020-12-14T02:20Z

EPSS history

Timeline

14 DEC 02:20Z
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control
cvelistv5