Medium severity · published Aug 13, 2025
CVE-2025-0818
Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion
6.5
CVSS
1%
EPSS
No
On KEV
Description
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution · saadiqbal
through 5.3.6 · source: vendor
FM
File Manager Pro · File Manager
through 8.4.2 · source: vendor
FM
File Manager Pro – Filester · ninjateam
through 1.8.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0818
github.com
https://github.com/Studio-42/elFinder
github.com
https://github.com/Studio-42/elFinder/blob/master/php/elFinder.class.php#L5367
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/library/php/elFinder.class.php#L5411
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/lib/php/elFinder.class.php#L5378
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/lib/php/elFinder.class.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3319016/filester
More from File Manager Pro
8.8
CVE-2024-8507
File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2024-8746
File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload
8.8
CVE-2024-7559
File Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload
5.4
CVE-2024-8918
File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload