Remote Code Execution Vulnerability in Simple-File-List Plugin for WordPress
CVE-2020-36847
9.8CRITICAL
What is CVE-2020-36847?
The Simple-File-List Plugin for WordPress contains a flaw that permits remote code execution. In versions up to and including 4.2.2, the rename function can be exploited by unauthenticated attackers, allowing the upload of PHP code disguised as a PNG file. This vulnerability poses significant security risks, enabling malicious actors to execute arbitrary code on the server, potentially compromising the entire WordPress site.
Affected Version(s)
Simple File List * < 4.2.3
References
EPSS Score
5% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
coiffeur