CVE-2026-16616
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
Risk Assessment
Exposure of sensitive files and the ability to move critical files can lead to full server compromise and site takeover.
Recommendation
Update the Simple File List plugin to version 6.3.12 or later if available, or restrict access to the file-move functionality.
Original NVD description (English source)
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.