# CVE-2026-12119: eemitch Simple File List missing authorization in frontmanage shortcode

Source: https://junglewise.ai/threats/cve-2026-12119-eemitch-simple-file-list-missing-authorization-in-frontmanage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-20. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-12119 · Severity: medium · CVSS 6.5 · Published 2026-06-20

The Simple File List plugin for WordPress, which allows users to manage and share files on their website, contains a security flaw that allows unauthorized file management. Authenticated users with low-level permissions (such as contributors) can delete, move, or create folders and download files they should not have access to. This could lead to the loss of important website documents or unauthorized access to private files.

Technologies: [Eemitch Simple File List](https://junglewise.ai/threats/technologies/simple-file-list). Vendors: [Eemitch](https://junglewise.ai/threats/vendors/eemitch).

## Quick answers

**Is CVE-2026-12119 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12119 being exploited in the wild.

**How severe is CVE-2026-12119?** Medium severity, with a CVSS score of 6.5, published 20 June 2026.

**Which products and versions are affected?** Eemitch Simple File List up to, and including, 6.3.7.

**Is there a fix for CVE-2026-12119?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12119 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12119?** Check whether you run Eemitch Simple File List at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check (CWE-862) exists in the 'frontmanage' shortcode attribute of the Simple File List plugin for WordPress. Authenticated attackers with contributor-level permissions or higher can exploit this by creating a draft post containing the 'eeSFL' shortcode. By viewing the post via the preview endpoint, the attacker can harvest the necessary security nonce. This nonce is then used to submit unauthorized file operation requests to 'includes/ee-list-ops-bar-process.php', bypassing intended access controls to delete, move, or create directories and download files. The vulnerability is present in all versions up to and including 6.3.7.

## Affected products

- eemitch Simple File List up to, and including, 6.3.7

## Timeline

- 2026-06-20: disclosed: Published by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-front-end.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-front-end.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-ops-bar-display.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-ops-bar-display.php)
- [https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-ops-bar-process.php](https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-ops-bar-process.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ed51a3-c049-4816-ada1-49f7edcb9a6f?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ed51a3-c049-4816-ada1-49f7edcb9a6f?source=cve)

## Related threats

- [Simple File List arbitrary file modification due to missing authorization](https://junglewise.ai/threats/cve-2026-11912-simple-file-list-arbitrary-file-modification-due-to-missing)
- [Simple File List arbitrary file deletion in eeSFL_DeleteFile](https://junglewise.ai/threats/cve-2026-11911-simple-file-list-arbitrary-file-deletion-in-eesfl-deletefile)