CVE-2026-11912: Simple File List WordPress Plugin Authorization Bypass – File Modification Vulnerability

Technical summary

CVE-2026-11912 is an authorization bypass vulnerability in Simple File List affecting versions ≤6.3.7. The vulnerability arises from improper authorization logic where an is_admin() check unconditionally short-circuits subsequent permission validation, including evaluation of the AllowFrontManage setting. This allows unauthenticated remote attackers to craft requests that bypass the intended access control, enabling arbitrary file deletion and modification operations. The flaw is classified under CWE-862 (Missing Authorization), with a CVSS v3.1 base score of 7.5 (High severity). The attack vector is network-based, requires no user interaction, and does not demand prior authentication or special privileges.

Business impact

Unrestricted file modification on WordPress sites poses substantial operational and confidentiality risks. Attackers can delete critical application files, corrupt configuration files, or inject malicious code into active theme and plugin files. This can lead to site defacement, malware installation, data exfiltration, or complete service disruption. Organizations relying on Simple File List for remote file management face particularly acute risk if the plugin is exposed to untrusted networks. Recovery from such compromise often requires forensic investigation, manual file restoration, and potential credential rotation across dependent systems.

Affected systems

The Simple File List WordPress plugin in all versions up to and including 6.3.7 is affected. The vulnerability is not dependent on WordPress core versions and affects any installation running a vulnerable version of the plugin, regardless of site configuration or the administrator's preference settings. Sites that have the plugin active but believe they have disabled the file management feature are equally vulnerable due to the authorization bypass.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and no special privilege escalation. An attacker with network access to the WordPress site can trigger the flaw via direct HTTP requests to affected endpoints. The authorization check flaw is unconditional, making exploitation straightforward. The vulnerability has not been designated as in-the-wild (KEV status: false as of the vulnerability's recent publication), but the simplicity of the attack pattern and the severity of the impact suggest rapid weaponization is likely.

Remediation

Immediately update the Simple File List plugin to a patched version released after 6.3.7. Verify the availability of a security patch from the plugin vendor before updating. As an interim mitigation, restrict HTTP access to the WordPress admin area and plugin endpoints using a Web Application Firewall (WAF) or network-level rules. Additionally, review file permissions on the server to limit the scope of damage an attacker can cause, and consider temporarily deactivating the plugin if it is not actively required.

Patch guidance

Check the Simple File List plugin repository or vendor advisory for a version newer than 6.3.7 that addresses this authorization flaw. Update via the WordPress admin dashboard's plugin update interface once a patched version is released and verified. Test the update in a staging environment first to ensure compatibility with your current WordPress configuration, themes, and other active plugins. After patching, review file access logs and recent file modifications to detect potential exploitation during the vulnerability window.

Detection guidance

Monitor for unauthenticated requests to Simple File List plugin endpoints that include file deletion or modification operations. Check server and web server logs for suspicious requests targeting the plugin's AJAX handlers or file management functions. Look for POST requests to plugin-specific endpoints originating from non-admin users or unusual geographic locations. Implement log aggregation and SIEM rules to flag any file deletion or modification events triggered by unauthenticated sessions. File integrity monitoring tools can alert on unauthorized changes to WordPress core files, themes, and plugins.

Why prioritize this

This vulnerability merits immediate patching priority due to its high CVSS score (7.5), ease of exploitation, and severe impact. The authorization bypass is unconditional and does not require exploitation of secondary factors. The ability to modify arbitrary files on the server means a single successful attack can compromise the entire WordPress installation and potentially pivot to other systems. Early patch deployment significantly reduces the attack surface.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects a network-exploitable flaw with no authentication or user interaction required and high integrity impact. The vulnerability affects the confidentiality and integrity of file data on the affected server. The score does not account for widespread deployment of the Simple File List plugin across many WordPress installations, which amplifies the overall ecosystem risk. Organizations should consider threat modeling specific to their environment, including network exposure and data sensitivity.

Frequently asked questions