CVE-2020-35235
About
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Rainforest analyst review
The secure-file-manager WordPress plugin loads elFinder without proper access control, so any authenticated user can invoke the upload command and land remote code execution. The privilege bar is nominally low, and the advisory adds a decisive detail: the product is no longer supported by its maintainer.
An authenticated-user RCE sounds gated until you remember that on many WordPress sites the pool of low-privilege accounts is large and easily obtained, so "any authenticated user" is a thin barrier. The abandonware status is the real story, though: there is no patch coming, ever, so the only fixes are removal or compensating controls.
Because updating isn't an option, our angle diverges from the usual patch flow. We inventory where this plugin is installed and push for outright removal or a virtual patch at the WAF layer, treating its presence as a standing liability rather than a version to bump. Unmaintained plugins are exactly the sprawl that hides in WordPress estates.
References
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2020-35235?
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
How severe is CVE-2020-35235?
CVE-2020-35235 carries a CVSS 3.1 base score of 8.8, rated high. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 89 out of 100, in the critical band.
How is CVE-2020-35235 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required Low, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2020-35235?
Public advisories list the following as affected: secure file manager. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2020-35235?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.