WordPress Plugin Wpfilemanager 6.8 RCE

Description

OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers exploit this vulnerability by injecting malicious commands through forms, cookies, or HTTP headers. These commands run with the privileges of the vulnerable application, leading to unauthorized access, data theft, and system compromise.

Recommendation

Update or remove the affected plugin.

References

• CVE-2020-25213
• CWE-20
• CWE-78
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP: Command Injection
• WordPress
• WordPress: File Manager

Related Issues

• Joomla! 1.5 < 3.4.5 RCE - CVE-2015-8562
• The ShellShock Bug - CVE-2014-6271, CVE-2014-7169, CVE-2014-6277, CVE-2014-6278
• WordPress 4.6 Blind OS Command Execution - CVE-2016-10033
• Apache 2.4.49 Path Traversal and RCE - CVE-2021-41773, CVE-2021-42013

Tags:

Wordpress

RCE

Command Injection

Input Validation

Injection

WASC-31

CVE-2020-25213

EDB-ID-49178

CWE-78

CWE-20

OWASP 2021-A3

OWASP 2017-A1

OWASP 2013-A1

OWASP 2010-A1

OWASP 2007-A2

OWASP 2021-A6

OWASP 2017-A9

CAPEC-88

CAPEC-310