# CVE-2026-11911: Simple File List arbitrary file deletion in eeSFL_DeleteFile

Source: https://junglewise.ai/threats/cve-2026-11911-simple-file-list-arbitrary-file-deletion-in-eesfl-deletefile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-20. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-11911 · Severity: high · CVSS 7.5 · Published 2026-06-20

The Simple File List plugin for WordPress, which allows users to manage and share files on their website, contains a security flaw that allows anyone to delete files from the server without logging in. By deleting critical system files like the website's configuration file, an attacker can take full control of the site or cause a complete service outage. This poses a significant risk to data integrity and website availability.

Technologies: [Eemitch Simple File List](https://junglewise.ai/threats/technologies/simple-file-list). Vendors: [Eemitch](https://junglewise.ai/threats/vendors/eemitch).

## Quick answers

**Is CVE-2026-11911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11911 being exploited in the wild.

**How severe is CVE-2026-11911?** High severity, with a CVSS score of 7.5, published 20 June 2026.

**Which products and versions are affected?** Eemitch Simple File List up to, and including, 6.3.7.

**Is there a fix for CVE-2026-11911?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11911 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-11911?** Check whether you run Eemitch Simple File List at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an arbitrary file deletion flaw (CWE-22) residing in the eeSFL_DeleteFile function of the Simple File List plugin. The root cause is insufficient validation of file paths provided to the simplefilelist_edit_job AJAX action, which is registered via wp_ajax_nopriv_, making it accessible to unauthenticated users. Furthermore, an is_admin() check intended to restrict access is bypassed because the function always returns true when processing requests through admin-ajax.php. An attacker can exploit this to delete sensitive files such as wp-config.php, potentially leading to a full site takeover or remote code execution. The issue is present in all versions up to and including 6.3.7.

## Affected products

- eemitch Simple File List up to, and including, 6.3.7

## Timeline

- 2026-06-20: disclosed: CVE published by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/748c4ca8-fcbf-43e5-ab70-721e83253663?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/748c4ca8-fcbf-43e5-ab70-721e83253663?source=cve)

## Related threats

- [eemitch Simple File List missing authorization in frontmanage shortcode](https://junglewise.ai/threats/cve-2026-12119-eemitch-simple-file-list-missing-authorization-in-frontmanage)
- [Simple File List arbitrary file modification due to missing authorization](https://junglewise.ai/threats/cve-2026-11912-simple-file-list-arbitrary-file-modification-due-to-missing)