CVE-2026-11911
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to and including 6.3.7. This allows unauthenticated attackers to delete arbitrary files on the server.
Risk Assessment
Attackers can delete critical files, potentially leading to remote code execution if the right file, such as wp-config.php, is deleted. This poses a serious security threat to the entire application.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability. Additionally, implementing further security measures, such as restricting access to critical files on the server, is advisable.
Other vulnerabilities in Simple File List plugin for WordPress
See all- CVE-2026-11912High
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to and including 6.3.7. This allows unauthenticated attackers to delete and modify files on the server.
- CVE-2026-12119Medium
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to and including 6.3.7. This allows authenticated attackers with contributor-level access and above to perform arbitrary file operations.
Original NVD description (English source)
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint.