Description

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-19T06:17:35.210Z",
  "pubdate": "2026-08-19T06:17:35.210Z",
  "executiveSummary": "An arbitrary file move vulnerability exists within the Simple File List WordPress plugin through version 6.3.11, allowing unauthenticated remote threat actors to read sensitive files and compromise the host system.\nThe vulnerability class involves improper input validation and insecure file operation handling, enabling unauthorized users to manipulate source and destination paths during file-move routines.\nAffected systems are WordPress installations running the Simple File List plugin in versions up to and including 6.3.11.\nThe risk implications are severe, encompassing sensitive information disclosure via unauthorized file reading and potential full site takeover through the relocation of critical application files out of the web root.\nAttack capabilities are granted to unauthenticated users over the network, requiring no prior privileges or interaction from legitimate administrators.\nExploitation requirements are minimal, as the vulnerable file-move operation is directly reachable via HTTP requests without session validation or access control enforcement.",
  "technicalDetails": "The root cause of the vulnerability lies in the complete lack of source path validation within the file-move execution logic exposed by the Simple File List WordPress plugin through version 6.3.11.\nThe vulnerable component handles file management functionalities intended for administrative users, but fails to implement proper authentication checks and input sanitization on incoming parameters controlling file relocation routines.\nNetwork exposure is direct, as the endpoint responsible for initiating file operations is accessible to unauthenticated remote attackers over HTTP or HTTPS.\nAuthentication requirements and privilege requirements are entirely absent, allowing any anonymous user to issue crafted requests directly to the vulnerable functionality.\nThe exploitation method involves sending maliciously crafted HTTP requests containing arbitrary source paths to the vulnerable file-move handler.\nThe step-by-step attack flow begins with the unauthenticated attacker identifying the target file path on the server, such as configuration files containing database credentials or system files.\nThe attacker then crafts a payload targeting the file-move operation within the Simple File List plugin, substituting the legitimate source parameter with the targeted sensitive file path.\nUpon receiving the request, the application executes the file-move logic without validating whether the supplied source path resides within the designated directories or if the user is authorized to perform file system modifications.\nPayload behavior manifests in two primary ways: reading arbitrary files via relocation or causing denial of service and site takeover by moving critical application files, such as wp-config.php, entirely out of the web root.\nThe post-exploitation impact includes unauthorized disclosure of sensitive server configuration data, exposure of credentials, and complete administrative compromise or functional incapacitation of the WordPress site."
}