# CVE-2026-11912: Simple File List arbitrary file modification due to missing authorization

Source: https://junglewise.ai/threats/cve-2026-11912-simple-file-list-arbitrary-file-modification-due-to-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-20. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-11912 · Severity: high · CVSS 7.5 · Published 2026-06-20

The Simple File List plugin for WordPress, which allows website owners to manage and share files, contains a security flaw that allows unauthorized users to modify or delete files on the server. This could lead to the loss of important documents or the defacement of the website. The issue exists even if the administrator has disabled front-end management settings, potentially impacting the integrity of the site's data.

Technologies: [Eemitch Simple File List](https://junglewise.ai/threats/technologies/simple-file-list). Vendors: [Eemitch](https://junglewise.ai/threats/vendors/eemitch).

## Quick answers

**Is CVE-2026-11912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11912 being exploited in the wild.

**How severe is CVE-2026-11912?** High severity, with a CVSS score of 7.5, published 20 June 2026.

**Which products and versions are affected?** Eemitch Simple File List up to, and including, 6.3.7.

**Is there a fix for CVE-2026-11912?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11912 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-11912?** Check whether you run Eemitch Simple File List at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to missing authorization checks (CWE-862) in multiple functions. The root cause is an improper use of the is_admin() check, which unconditionally short-circuits security guards before the 'AllowFrontManage' setting is evaluated. This allows an unauthenticated remote attacker to bypass intended restrictions and perform file operations, including deletion and modification, via network requests. The vulnerability affects all versions up to 6.3.7; users should update to a patched version if available.

## Affected products

- eemitch Simple File List up to, and including, 6.3.7

## Timeline

- 2026-06-20: disclosed: CVE published to NVD dataset

## References

- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/509a40d2-a33a-49ba-b858-fa8805127a1b?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/509a40d2-a33a-49ba-b858-fa8805127a1b?source=cve)

## Related threats

- [eemitch Simple File List missing authorization in frontmanage shortcode](https://junglewise.ai/threats/cve-2026-12119-eemitch-simple-file-list-missing-authorization-in-frontmanage)
- [Simple File List arbitrary file deletion in eeSFL_DeleteFile](https://junglewise.ai/threats/cve-2026-11911-simple-file-list-arbitrary-file-deletion-in-eesfl-deletefile)