CVE-2025-0818 is a directory traversal vulnerability affecting WordPress plugins that utilize elFinder versions 2.1.64 and earlier. This flaw allows unauthenticated attackers to delete arbitrary files, provided the site owner has explicitly exposed the file manager to users. The vulnerability carries a CVSS score of 6.5 (Medium) due to its network attack vector and high integrity impact, though it requires specific user interface interaction for successful exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Saadiqbal | Advanced File Manager – Ultimate File Manager For WordPress And Document Library Solution | >= 0, <= 5.3.6CNA affecteddefault unaffected | |
| Ninjateam | File Manager Pro – Filester | >= 0, <= 1.8.9CNA affecteddefault unaffected | |
| File Manager | File Manager Pro | >= 0, <= 8.4.2CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.