WordPress Plugin Vulnerabilities

Multiple elFinder Plugins - Arbitrary File Deletion via Traversal

Description

Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.

Affects Plugins

Plugin icon
file-manager-advanced
Fixed in 5.4.0
Plugin icon
filester
Fixed in 1.9
Plugin icon
wp-file-manager-pro
Fixed in 8.4.3

References

CVE
CVE-2025-0818
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a166de-3bdf-4883-91ba-655f2757c53b

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
tiborisaak
Verified
No
WPVDB ID
9569aaa4-719a-4f2e-b5f4-e74fe84e7ad8

Timeline

Publicly Published
2025-08-12 (about 9 months ago)
Added
2025-08-12 (about 9 months ago)
Last Updated
2025-12-03 (about 5 months ago)

Other

Published
Title
Published
2026-02-09
Title
Simple File List < 6.1.16 - Authenticated (Subscriber+) Arbitrary File Download
Published
2025-05-14
Title
File Manager Advanced Shortcode <= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode
Published
2024-11-08
Title
WooCommerce Support Ticket System < 17.8 - Unauthenticated Arbitrary File Deletion
Published
2026-03-20
Title
Keep Backup Daily < 2.1.3 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter
Published
2024-12-30
Title
WPMasterToolKit < 1.14.0 - Authenticated (Admin+) Arbitrary File Download