Risk Description:
The Bhutan Computer Incident Response Team recommends WordPress website administrators about the new Vulnerability identified in the File Manager plugin which allows remote code execution. File Manager Plugin allows site Admins to upload, edit. delete files and folders directly from the WordPress backend without having to use FTP. If the vulnerability exploited successfully, it would allow attacker to upload web shell disguised inside an image file on the victim’s server. The attacker then access the web shell and take over the victim’s site.
Versions Affected:
- File manager versions 6.0 – 6.8
Recommendations:
- Apply appropriate updates provided by File Manager to the affected systems immediately.
References:
- https://www.wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
- https://www.cisecurity.org/advisory/a-vulnerability-in-wordpress-file-manager-plugin-could-allow-for-remote-code-execution_2020-123/
- https://github.com/w4fz5uck5/wp-file-manager-0day
- https://www.zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/
- https://www.cirt.gov.bd/a-vulnerability-in-wordpress-file-manager-plugin-could-allow-for-remote-code-execution/
Team BtCIRT
Stay safe!