Executive brief
The Simple File List plugin for WordPress, which allows users to manage and share files on their website, contains a security flaw that allows anyone to delete files from the server without logging in. By deleting critical system files like the website's configuration file, an attacker can take full control of the site or cause a complete service outage. This poses a significant risk to data integrity and website availability.
Technical details
The vulnerability is an arbitrary file deletion flaw (CWE-22) residing in the eeSFL_DeleteFile function of the Simple File List plugin. The root cause is insufficient validation of file paths provided to the simplefilelist_edit_job AJAX action, which is registered via wp_ajax_nopriv_, making it accessible to unauthenticated users. Furthermore, an is_admin() check intended to restrict access is bypassed because the function always returns true when processing requests through admin-ajax.php. An attacker can exploit this to delete sensitive files such as wp-config.php, potentially leading to a full site takeover or remote code execution. The issue is present in all versions up to and including 6.3.7.
Affected products
- eemitch Simple File List up to, and including, 6.3.7
Timeline
- 2026-06-20: disclosed: CVE published by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/748c4ca8-fcbf-43e5-ab70-721e83253663?source=cve