CVE-2020-36847

CriticalPublished

Simple File List < 4.2.3 - Remote Code Execution

Published: Jul 12, 2025
Updated: Apr 8, 2026
Assigning CNA: Wordfence
Evidence observed: Jul 22, 2025

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

43.5%

Moderate · next 30 days

Percentile: 98.7%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

WordPress Simple File List Unauthenticated Remote Code ExecutionModule
modules/exploits/multi/http/wp_simple_file_list_rce.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- platform: PHP($.exploit_multi/http/wp_simple_file_list_rce.platform)
- verification: check_declared($.exploit_multi/http/wp_simple_file_list_rce.check)

CVE-2025-34085Exploit
Exploit for CVE-2025-34085
Simple File List WordPress Plugin 4.2.2 - File Upload to RCEExploit
Md Amanat Ullah (xSwads) · multiple · Jul 22, 2025

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.