CVE-2026-12119: WordPress Simple File List Plugin Authorization Bypass

Technical summary

CVE-2026-12119 is an authorization bypass vulnerability in the Simple File List WordPress plugin stemming from insufficient permission validation on the 'eeSFL' shortcode and related file operation handlers in includes/ee-list-ops-bar-process.php. The vulnerability permits authenticated users at contributor level or above to harvest valid nonces via the post preview endpoint and submit crafted requests that circumvent authorization checks. The attack chain does not require administrator privileges, social engineering, or user interaction beyond normal WordPress functionality, making it accessible to any authenticated account with minimal permissions.

Business impact

Organizations relying on Simple File List for content management or document handling face data loss, unauthorized file manipulation, and potential service disruption. An attacker with a low-privilege account—such as a freelancer or temporary contractor—could delete critical files, reorganize content structures, or exfiltrate sensitive documents without administrative oversight. The reputational and compliance implications depend on what files are stored; exposure of customer data, intellectual property, or regulated information amplifies risk.

Affected systems

All versions of the Simple File List WordPress plugin through version 6.3.7 are affected. The vulnerability is post-authentication, requiring an attacker to hold at least contributor-level access to a WordPress installation where the plugin is active. Multisite WordPress deployments and single-site installations are equally vulnerable if the plugin is enabled.

Exploitability

Exploitability is straightforward given low barriers to entry. An attacker needs valid WordPress credentials at contributor level—often granted to content creators, authors, or temporary staff—and no special tools or knowledge. The nonce extraction via post preview is a standard WordPress feature, and file operation requests can be crafted with basic HTTP knowledge. No user interaction is required once credentials are obtained. The vulnerability is not known to be actively exploited in the wild, but the attack surface and ease of execution make it a plausible target for insider threats and compromised low-privilege accounts.

Remediation

Update the Simple File List plugin to a patched version released after June 20, 2026 that implements proper authorization checks. Verify the patch version against the official WordPress plugin repository or vendor advisory. Until patching is feasible, restrict contributor-level access to users who genuinely require it, disable the plugin if it is not actively used, and monitor file operations and access logs for anomalous activity.

Patch guidance

Check the Simple File List plugin repository on wordpress.org for versions released after the vulnerability publication date of June 20, 2026. Apply the latest patched version through the WordPress admin dashboard. After updating, verify that file operation functionality still works as intended in a test environment. For sites unable to patch immediately, disable the plugin and re-enable it only after a fix is applied.

Detection guidance

Monitor WordPress audit logs and file access logs for unusual file deletion, movement, or download activity originating from contributor-level accounts. Look for POST requests to includes/ee-list-ops-bar-process.php with parameters indicative of file operations (delete, move, mkdir, download). Check for multiple file operations within a short window or operations targeting sensitive directories. Set up alerts on WordPress nonce generation and use via the preview endpoint, especially if followed by file operation requests from the same user session.

Why prioritize this

Although the CVSS score of 6.5 reflects medium severity, the practical risk is elevated by the low authentication barrier and insider threat potential. Contributor-level accounts are commonly granted to non-technical staff and external partners, widening the attack surface. File operations can cause immediate, irreversible damage (deletion, data loss). Organizations with strict least-privilege policies or those where file content is business-critical should prioritize patching. If the plugin is not essential, disabling it is the fastest mitigation.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the requirement for prior authentication (PR:L) and the absence of confidentiality impact (C:N). However, the integrity impact (I:H) is substantial—authorized file deletion and manipulation directly compromise data integrity. The score does not fully capture insider threat dynamics or the reputational cost of accidental data loss, which may justify accelerated patching in sensitive environments.

Frequently asked questions