On this page
Atomicorp WAF Rule 393781
Rule Summary
- Rule ID: 393781
- Status: Active
- Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: WordPress File Manager Plugin attack blocked
- Observed CWEs: CWE-20 (1), CWE-22 (2), CWE-78 (2), CWE-306 (2), CWE-434 (4), CWE-918 (1)
- Revision: 1
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request URI
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: WordPress File Manager Plugin attack blocked” in the request URI. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2019-9194 | elFinder PHP Connector exiftran Command Injection | elfinder | 9.8 (v3.0) | Critical |
| CVE-2020-25213 | WordPress File Manager Unauthenticated Remote Code Execution | file manager | 9.8 (v3.1) | Critical |
| CVE-2021-23394 | elFinder < 2.1.58 - Remote Code Execution | elfinder | 9.8 (v3.1) | Critical |
| CVE-2021-32682 | elFinder ZIP Arguments Injection Leads to Commands Injection (CVE-2021-32682) | elfinder | 9.8 (v3.1) | Critical |
| CVE-2021-43421 | Studio-42 elFinder <2.1.60 - Arbitrary File Upload | elfinder | 9.8 (v3.1) | Critical |
| CVE-2025-34111 | Tiki Wiki Unauthenticated File Upload Vulnerability | tikiwiki cms/groupware | 9.3 (v4.0) | Critical |
| CVE-2022-26960 | elFinder <=2.1.60 - Local File Inclusion | elfinder | 9.1 (v3.1) | Critical |
| CVE-2023-54350 | WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated | Augmented Reality | 8.7 (v4.0) | High |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.