CVE-2026-11912

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.

• CWE-862

• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php#L1265
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php#L1586
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php#L880
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php#L473
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php#L262
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/509a40d2-a33a-49ba-b858-fa8805127a1b?source=cve

Published

Jun 20, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11906IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for…6.5
• CVE-2026-11907The Stream plugin for WordPress is vulnerable to authorizati…6.5
• CVE-2026-11908Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-11909Missing Authorization vulnerability in Drupal Examples for D…3.3
• CVE-2026-1191The JavaScript Notifier plugin for WordPress is vulnerable t…4.4
• CVE-2026-11911The Simple File List plugin for WordPress is vulnerable to a…7.5
• CVE-2026-11913vulnerability in Drupal Mother May I allows . This issue aff…9.8
• CVE-2026-11914vulnerability in Drupal Composer allows . This issue affects…5.9
• CVE-2026-11915vulnerability in Drupal Brute force attack protection allows…5.9
• CVE-2026-11917A path traversal security issue exists within Rockwell Autom…7.2
• CVE-2026-1192A vulnerability was determined in Tosei Online Store Managem…7.3
• CVE-2026-11920The JoomSport – for Sports: Team & League, Football, Hockey …4.9