Exploits in the Wild for Word Press File Manager RCE Vulnerability (CVE-2020-25213)
Summary: In December 2020, Unit 42 researchers observed in-the-wild exploitation of CVE-2020-25213, a file upload flaw in the WordPress File Manager plugin that lets an attacker upload arbitrary files with arbitrary names and extensions, leading to remote code execution on the web server. Attackers used it to install webshells, including one named k.php that ran a curl command to download and execute wpf.sh, which in turn downloaded Kinsing, a Golang-based malware running an H2miner-family cryptominer aimed at container environments.
Why it matters: The root cause was a single plugin file, connector.minimal.php.dist, renamed to .php and left with no access restrictions, so anyone browsing the web server could upload files without authentication - and the resulting Kinsing payload targets container environments, not just the WordPress host.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-25213
- Related
- CVE-2020-25213: Word Press File Manager Plugin Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021