Act now to eliminate the WordPress cybersecurity vulnerability due to the WordPress file manager plugin

If you are still using the file manager versions 6.0 – 6.8 on WordPress, you need to upgrade immediately, here’s why!


The world witnessed a series of WordPress sites being hacked, and if you are still unaware of the WordPress security issues that surfaced recently due to the WordPress file manager plugin, here’s is all you need to know.

  • The WordPress File Manager versions 6.0 – 6.8 are being targetted and are the reason behind the WordPress Websites Attacked worldwide. A record of around 1.7 million sites has undergone a WordPress security issue in a matter of a few days now.
  • The file manager vulnerability attacks occurred due to the WordPress file manager plugin extension elFinder, an open-source library file, which was wrongly named to .php from connector.minimal.php.dist. This renaming allowed unauthenticated users to gain access to the file manager.
  • Hackers, before going with a malicious attempt on a WordPress site, have been trying to introduce harmless, empty files, to begin with, and upon gaining access to the website after successfully overcoming the WordPress cybersecurity, have submitted malicious files.
  • Wordfence, the WordPress security firm, has come up with a list of files that have been uploaded repeatedly, including hardfork.php, hardfind.php, and x.php. The most frequently uploaded file being Feoidasf4e0_index.php.
  • The hackers have been blocking other hackers from gaining access once taking over the admin control, which enables them to edit, upload, delete the contents of the website as they see fit.

What should you do to prevent WordPress cybersecurity vulnerability due to the WordPress file manager plugin from affecting your WordPress site?

The Wordfence Threat Intelligence team, upon being notified of the zero-day vulnerability, came up with a release of a patched version of the WordPress file manager plugin with a way to protect against the file manager vulnerability attacks.

Our cybersecurity experts at Infomaze suggest that you immediately upgrade your WordPress file manager plugin if you are still using the file manager versions 6.0 – 6.8 to the latest patched plugin version 6.9.


The patched version prevents hackers from exploiting the vulnerability by completely deleting the lib/php/connector.minimal.php file from the plugin. The same can be done manually while still maintaining the functionality and WordPress cybersecurity.

If you are not using the WordPress file manager plugin actively, we recommend that you uninstall it and activate it on a need-to basis.

Make sure the firewall in use is up-to-date and effective when faced with a threat and is ready to prevent the effect of the malware on your WordPress site.

How can Infomaze help you stay secure in the presence of a WordPress file manager plugin vulnerability issue?


With years of experience being a WordPress development company among the other IT services we provide, and with the help of the security, maintenance, and support services that our sister company provides, we provide an overall protection every content management system requires to remain secure.

With the help of our Vulnerability management services to managed security monitoring, we provide the best protection from cyber-attackers. We make sure and take care that you will never have to worry about being vulnerable or at a high risk of getting hacked and affecting your website ranking in the process.

Are you interested in getting to know more about the current updates on the WordPress cybersecurity vulnerability? If yes, head to the Wordfence blog Millions of Sites Targeted in File Manager Vulnerability Attacks. They have listed the IP addresses, which have been frequently used to cause the attacks.

OR are you more worried about maintaining your WordPress and other IT environment secure? If so, our knowledgeable WordPress developers are here to help, be it consulting services, WordPress development services, or managed security services.