IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Millions of WordPress sites targeted by File Manager zero-day

A dramatic surge in attacks saw one million sites targeted on 4 September alone

More than 1.7 million sites designed on the WordPress platform have been attacked due to a zero-day vulnerability in the File Manager plugin, with hundreds of thousands more sites likely to be under threat.

Attacks against a flaw in the File Manager plugin surged dramatically towards the end of last week, according to researchers with the Wordfence security plugin, with attacks against one million sites on 4 September alone.

Hackers have been exploiting the flaw in the wild by executing commands to upload malicious files onto target WordPress sites. Analysis by Wordfence’s threat intelligence team showed it was also possible to bypass the in-built file upload protection mechanism.

Although a patch has been released, labelled as version 6.9 of the plugin, as of last Friday there were still 261,800 sites running a vulnerable form of File Manager. Sites not using the plugin are still being probed by bots seeking to exploit vulnerable versions of the app. 

Of the three million WordPress sites that Wordfence protects, 1.7 million have been probed for the vulnerability, meaning the true extent of the exploitation is unknown and likely much higher than reported figures.

File Manager is designed to help administrators manage files on their sites, and offers an additional library known as elFinder which is an open-source file manager designed to provide a simple user interface. 

The issue centres on the File Manager plugin renaming the extension on the elFinder library 'connector.minimal.php.dist' file to '.php', meaning it can be executed directly - even though the connector file isn’t used by File Manager itself. The file had no direct access restrictions, meaning it could be accessed by anyone. 

The attacks that Wordfence researchers have seen in the wild involved hackers using the upload command to upload PHP files containing webshells hidden in an image.

Beyond applying the patch, Wordpress users are being offered an extra layer of protection thanks to an additional firewall rule that prevents all access to ‘connector.minimal.php’.

Wordfence has also recommended that users not actively using the plugin should uninstall it completely to avoid any risk.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download


Kaspersky exposes MysterySnail zero-day exploit in Windows
zero-day exploit

Kaspersky exposes MysterySnail zero-day exploit in Windows

13 Oct 2021

Most Popular

16 ways to speed up your laptop

16 ways to speed up your laptop

13 May 2022
Preparing for the 3G sunset
Network & Internet

Preparing for the 3G sunset

18 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022