## https://sploitus.com/exploit?id=219D157F-5833-58E8-8C38-B9B568CED67E
# wp-file-manager-poc-chain
A professional offensive security proof-of-concept and analysis for CVE-2020-25213, the WordPress File Manager arbitrary file upload vulnerability. This repository includes a multipurpose PHP payload, an upload script, and technical documentation covering reverse proxy scattering and post-exploitation pivoting.
**For authorized security testing and educational use only.**
Overview:
CVE-2020-25213 is an unauthenticated arbitrary file upload in the WordPress File Manager plugin, versions 6.0 through 6.8. The vulnerable endpoint `connector.minimal.php` allows attackers to upload a PHP file to the web-accessible `lib/files/` directory, leading to remote code execution.
Contents:
| File | Description |
|------|-------------|
| `poc_upload.py` | Python script to upload a payload to a vulnerable WordPress instance. |
| `core.php` | Multipurpose PHP payload with three modes: reverse shell, command exec, file read. |
| `analysis.md` | Technical analysis of the vulnerability, exploitation nuances, and mitigations. |
| `LICENSE` | MIT License. |
** Disclaimer **
The author is not responsible for any misuse of this code. Use only on systems with explicit authorization.
** License **
Released under the MIT License. See `LICENSE`.