Simple File List plugin for WordPress vulnerabilities
3 known CVE vulnerabilities in Simple File List plugin for WordPress, translated and rated.
- CVE-2026-11912High
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to and including 6.3.7. This allows unauthenticated attackers to delete and modify files on the server.
- CVE-2026-12119Medium
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to and including 6.3.7. This allows authenticated attackers with contributor-level access and above to perform arbitrary file operations.
- CVE-2026-11911High
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to and including 6.3.7. This allows unauthenticated attackers to delete arbitrary files on the server.