
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2020-35235 affects the secure-file-manager WordPress plugin through version 2.5. The vulnerability exists in the vendor/elfinder/php/connector.minimal.php file, which loads elFinder code without proper access control. The issue was discovered in November 2020 and the plugin was subsequently removed from the WordPress repository due to security concerns (NinTechNet Blog, WordPress Plugin).
The vulnerability stems from improper access control implementation in the elFinder libraries. The only security check implemented is the wp_validate_auth_cookie function, which merely verifies if a user is authenticated. The plugin lacks proper capability checks and security nonces, allowing any authenticated user to execute file manager commands. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, WPScan).
The vulnerability allows any authenticated user to execute arbitrary file management commands, including file upload, download, rename, create, view, and delete operations. These operations can be performed in any directory within the virtual host, potentially leading to remote code execution through malicious file uploads (NinTechNet Blog).
The vulnerability is easily exploitable by any authenticated user. Proof of concept exploits have been publicly documented, demonstrating both arbitrary file access and remote code execution capabilities. The attack can be executed through crafted HTTP requests to the vulnerable connector.minimal.php file (WPScan).
Since the plugin is no longer maintained and no security patch is available, the recommended mitigation is to completely uninstall the plugin from WordPress installations. Users of NinjaFirewall WP Edition (free) and NinjaFirewall WP+ Edition (premium) are protected against this vulnerability (NinTechNet Blog).
The WordPress.org plugins team removed the plugin from their repository on September 8, 2020, after unsuccessful attempts to contact the author about the security issue. The plugin was officially closed as of September 1, 2021, due to security concerns (WordPress Plugin).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."