[Vulnerability Recurrence] WordPress plugin wp-file-manager arbitrary file upload vulnerability (CVE-2020-25213)

---

Preface

There is a serious security vulnerability in the WordPress plug-in WPFileManager, which allows an attacker to arbitrarily upload files and perform remote code execution on any WordPress website where this plug-in is installed.

statement

Please do not use the relevant technologies in this article to engage in illegal testing. Any direct or indirect consequences and losses caused by the dissemination and use of the information or tools provided in this article are the responsibility of the user himself. All adverse consequences and The author of the article is irrelevant. This article is for educational purposes only.

1. Introduction

WordPress is a blogging platform developed using PHP language. Users can set up their own website on a server that supports PHP and MySQL databases. You can also use WordPress as a content management system (CMS).