CVE-2026-11912

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.

• CWE-862

• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php#L1265
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php#L1586
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-functions.php#L880
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/includes/ee-list-display.php#L473
• https://plugins.trac.wordpress.org/browser/simple-file-list/tags/6.3.6/simple-file-list.php#L262
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/509a40d2-a33a-49ba-b858-fa8805127a1b?source=cve

Published

Jun 20, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119113The GeoDirectory – WP Business Directory Plugin and Classifi…6.4
• CVE-2026-119115Incorrect authorization in the issuer resolution logic in AW…8.5
• CVE-2026-119116A use-after-free and double-free issue in the SetClient comm…7.8
• CVE-2026-119117Insertion of sensitive information into a log file in Amazon…6.5
• CVE-2026-119118Crawl4AI before 0.9.5 contains an improper certificate valid…6.5
• CVE-2026-119119Crawl4AI before 0.9.5 contains a denial of service vulnerabi…7.5
• CVE-2026-119120Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineS…7.5
• CVE-2026-119121Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injec…4.3
• CVE-2026-119122Crawl4AI before 0.9.5 contains a blind server-side request f…5.3
• CVE-2026-119123ImageMagick before 7.1.2-34 contains a stack overflow vulner…3.7
• CVE-2026-119124ImageMagick before 7.1.2-34 contains a heap-based buffer ove…5.5
• CVE-2026-119125Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 …3.1