The File Manager plugin, 700,000 sites up for takeover in one afternoon
The "File Manager" plugin does exactly what it promises, it lets you manage the site's files from the WordPress panel. Convenient. The problem is that in 2020 that convenience opened a door to hundreds of thousands of sites at once.
What happened
In File Manager (CVE-2020-25213) a flaw was found that allowed uploading any file without logging in to the server, including a PHP file, that is, working code. The attacker dropped in a so-called webshell (a back door) and from that moment had full control: they could read the database, create administrator accounts, send spam.
The plugin was installed on over 700,000 sites. When the flaw came to light, bots started mass-scanning the internet; the first attacks began within hours of publication.
Why it is so dangerous
Uploading your own code to the server is the worst possible scenario, it is not "swapping some text", it is taking over the whole machine. And file manager plugins are the perfect target, because by design they operate on files.
What to do
- Do not keep file management plugins installed permanently. Install, use, remove. Every day "just in case" is a risk.
- Update plugins immediately: the File Manager patch came out fast, but hours mattered.
- Limit the number of plugins. Fewer add-ons = a smaller attack surface.
The rule is brutally simple: every plugin is a potential door. As part of our care service we keep track of which plugins you have, whether they are up to date and whether they are needed at all, reach out.
Source: NVD, CVE-2020-25213.