CVE-2020-35235: 
WordPress vulnerability analysis and mitigation

CVE-2020-35235 affects the secure-file-manager WordPress plugin through version 2.5. The vulnerability exists in the vendor/elfinder/php/connector.minimal.php file, which loads elFinder code without proper access control. The issue was discovered in November 2020 and the plugin was subsequently removed from the WordPress repository due to security concerns (NinTechNet Blog, WordPress Plugin).

The vulnerability stems from improper access control implementation in the elFinder libraries. The only security check implemented is the wp_validate_auth_cookie function, which merely verifies if a user is authenticated. The plugin lacks proper capability checks and security nonces, allowing any authenticated user to execute file manager commands. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, WPScan).

The vulnerability allows any authenticated user to execute arbitrary file management commands, including file upload, download, rename, create, view, and delete operations. These operations can be performed in any directory within the virtual host, potentially leading to remote code execution through malicious file uploads (NinTechNet Blog).

The vulnerability is easily exploitable by any authenticated user. Proof of concept exploits have been publicly documented, demonstrating both arbitrary file access and remote code execution capabilities. The attack can be executed through crafted HTTP requests to the vulnerable connector.minimal.php file (WPScan).

Since the plugin is no longer maintained and no security patch is available, the recommended mitigation is to completely uninstall the plugin from WordPress installations. Users of NinjaFirewall WP Edition (free) and NinjaFirewall WP+ Edition (premium) are protected against this vulnerability (NinTechNet Blog).

The WordPress.org plugins team removed the plugin from their repository on September 8, 2020, after unsuccessful attempts to contact the author about the security issue. The plugin was officially closed as of September 1, 2021, due to security concerns (WordPress Plugin).