Simple File List, CVE-2026-11911

CVE, Research URL: CVE-2026-11911
Home page URL: Security reports for Simple File List
Application: Simple File List
Published on: Jun 20, 2026
Research Description: The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint.
Affected versions: max 6.3.8.
Status: vulnerable