CVE-2026-39792: WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Q: Who can exploit this issue?

The issue is described as unauthenticated, so an attacker does not need a WordPress account or prior privileges to exploit it.

Q: What is the likely impact of successful exploitation?

Successful exploitation can allow arbitrary file deletion. The supplied CVSS vector rates availability impact as high, indicating deletion may cause significant service disruption.

Q: Which installations should be considered affected?

WordPress sites using the Simple File List plugin at version 6.3.11 or earlier should be considered affected based on the provided version range.

Published Oct 6, 2026

Updated

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

Affected Software

1 affected component

WordPress Simple File List<=6.3.11

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is described as unauthenticated, so an attacker does not need a WordPress account or prior privileges to exploit it.

What is the likely impact of successful exploitation?

Successful exploitation can allow arbitrary file deletion. The supplied CVSS vector rates availability impact as high, indicating deletion may cause significant service disruption.

Which installations should be considered affected?

WordPress sites using the Simple File List plugin at version 6.3.11 or earlier should be considered affected based on the provided version range.

CVE-2026-39792: WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of successful exploitation?

Which installations should be considered affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of successful exploitation?

Which installations should be considered affected?