CVE-2026-16616: Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
WordPress sites using the Simple File List plugin through version 6.3.11 are affected. The vulnerable file-move operation is reachable without authentication.
What does an attacker need to exploit this issue?
An attacker does not need a WordPress account or other authentication. They need to be able to reach the vulnerable file-move operation and supply a crafted source path that traverses outside the intended directory.
What could an attacker do successfully?
The issue can allow reading arbitrary files on the server and moving critical files out of the web root. This may disclose sensitive information and could lead to site takeover.