Executive brief
The Simple File List plugin for WordPress, which allows website owners to manage and share files, contains a security flaw that allows unauthorized users to modify or delete files on the server. This could lead to the loss of important documents or the defacement of the website. The issue exists even if the administrator has disabled front-end management settings, potentially impacting the integrity of the site's data.
Technical details
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to missing authorization checks (CWE-862) in multiple functions. The root cause is an improper use of the is_admin() check, which unconditionally short-circuits security guards before the 'AllowFrontManage' setting is evaluated. This allows an unauthenticated remote attacker to bypass intended restrictions and perform file operations, including deletion and modification, via network requests. The vulnerability affects all versions up to 6.3.7; users should update to a patched version if available.
Affected products
- eemitch Simple File List up to, and including, 6.3.7
Timeline
- 2026-06-20: disclosed: CVE published to NVD dataset
References
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php
- https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/509a40d2-a33a-49ba-b858-fa8805127a1b?source=cve