CVE-2026-11911: Simple File List WordPress Plugin Arbitrary File Deletion Vulnerability

Technical summary

CVE-2026-11911 stems from improper input validation in the eeSFL_DeleteFile function within the Simple File List plugin. The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, which exposes it to unauthenticated requests. Although the code includes an is_admin() guard, it is ineffective because is_admin() returns true for all requests routed through wp-admin/admin-ajax.php, regardless of user authentication status. An attacker can manipulate the file path parameter to traverse the filesystem and target arbitrary files, leading to arbitrary file deletion (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). Removal of critical files such as wp-config.php can degrade availability and facilitate remote code execution.

Business impact

A successful attack could result in immediate website downtime, data loss, and potential compromise of database credentials and encryption keys stored in wp-config.php. For e-commerce or content-driven sites, this translates to lost revenue and customer trust. The ability to delete files also creates a pathway to remote code execution, which could lead to full server compromise, data theft, and lateral movement within the organization's infrastructure. Websites running this plugin are at high risk of becoming attack targets.

Affected systems

WordPress sites running the Simple File List plugin in version 6.3.7 or earlier are vulnerable. The plugin is actively used on thousands of WordPress installations. Any site with this plugin installed—regardless of whether the plugin is actively used—presents an attack surface, since the vulnerable AJAX endpoint is accessible by default.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.5 (HIGH) and is trivially exploitable over the network without authentication or user interaction. An attacker needs only to craft a specially formed HTTP request to the wp-admin/admin-ajax.php endpoint specifying a malicious file path in the AJAX parameter. No special tools, credentials, or social engineering are required, making this a high-priority exploitation target for both opportunistic scanners and targeted attacks.

Remediation

Site administrators should immediately update the Simple File List plugin to a patched version released after 6.3.7. Verify the patched version against the official plugin repository and the vendor's security advisory. As a temporary mitigation, disable or remove the Simple File List plugin if it is not actively in use. Additionally, implement Web Application Firewall (WAF) rules to block requests to wp-admin/admin-ajax.php with suspicious file path traversal patterns.

Patch guidance

Update the Simple File List plugin through the WordPress admin dashboard (Plugins → Updates) or manually upload a version confirmed to be patched against this vulnerability. Verify against the official WordPress plugin repository and the vendor's advisory to confirm the version addresses CVE-2026-11911. Test the updated plugin on a staging environment before deploying to production to ensure compatibility with other plugins and themes.

Detection guidance

Monitor web server and WordPress access logs for requests to wp-admin/admin-ajax.php containing the action parameter 'simplefilelist_edit_job' paired with suspicious file path parameters (e.g., '../', '..\', or references to wp-config.php, .htaccess, or system files). Implement alerting for failed file access attempts or unexpected file deletions detected via file integrity monitoring tools. WordPress security plugins such as Wordfence or Sucuri can provide real-time detection of exploitation attempts targeting this endpoint.

Why prioritize this

This vulnerability ranks as HIGH priority due to its unauthenticated exploitability, trivial attack complexity, and direct path to server compromise via file deletion. The attack surface is large (all versions up to 6.3.7 worldwide), and the impact extends from availability disruption to confidentiality and integrity violations if critical configuration files are removed. Organizations running WordPress should treat this as an emergency patch.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible vulnerability requiring no authentication or user interaction (AV:N, PR:N, UI:N). While the vector shows only high confidentiality impact (C:H, I:N, A:N), the practical risk is elevated by the ability to achieve remote code execution through strategic file deletion, effectively unlocking integrity and availability impacts that the CVSS vector understates. The lack of KEV status does not diminish the urgency; this is a newly disclosed vulnerability with obvious exploitation paths.

Frequently asked questions