CVE-2022-1119

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.

• CWE-22
• CWE-22

• https://docs.google.com/document/d/1qIZXTzEpI4tO6832vk1KfsSAroT0FY2l--THlhJ8z3c/editExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/simple-file-list/trunk/includes/ee-downloader.php?rev=2071880Patch, Third Party Advisory
• https://wpscan.com/vulnerability/075a3cc5-1970-4b64-a16f-3ec97e22b606Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ff21241d-e488-4460-b8c2-d5a070c8c107?source=cve
• https://docs.google.com/document/d/1qIZXTzEpI4tO6832vk1KfsSAroT0FY2l--THlhJ8z3c/editExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/simple-file-list/trunk/includes/ee-downloader.php?rev=2071880Patch, Third Party Advisory
• https://wpscan.com/vulnerability/075a3cc5-1970-4b64-a16f-3ec97e22b606Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ff21241d-e488-4460-b8c2-d5a070c8c107?source=cve

Published

Apr 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1113The Flower Delivery by Florist One WordPress plugin through …4.8
• CVE-2022-1114A heap-use-after-free flaw was found in ImageMagick's Relinq…7.1
• CVE-2022-1115A heap-buffer-overflow flaw was found in ImageMagick’s PushS…5.5
• CVE-2022-1116Integer Overflow or Wraparound vulnerability in io_uring of …7.8
• CVE-2022-1117A vulnerability was found in fapolicyd. The vulnerability oc…8.4
• CVE-2022-1118Connected Components Workbench (v13.00.00 and prior), ISaGRA…7.8
• CVE-2022-1120Missing filtering in an error message in GitLab CE/EE affect…6.5
• CVE-2022-1121A lack of appropriate timeouts in GitLab Pages included in G…5.3
• CVE-2022-1122A flaw was found in the opj2_decompress program in openjpeg2…5.5
• CVE-2022-1123The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Ma…7.2
• CVE-2022-1124An improper authorization issue has been discovered in GitLa…4.3
• CVE-2022-1125Use after free in Portals in Google Chrome prior to 100.0.48…8.8