CVE-2020-35235

2020-12-1402:20:27

mitre

www.cve.org

9.1 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.6%

JSON

vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer