Remote Code Execution Vulnerability in Simple-File-List Plugin for WordPress

CVE-2020-36847

What is CVE-2020-36847?

The Simple-File-List Plugin for WordPress contains a flaw that permits remote code execution. In versions up to and including 4.2.2, the rename function can be exploited by unauthenticated attackers, allowing the upload of PHP code disguised as a PNG file. This vulnerability poses significant security risks, enabling malicious actors to execute arbitrary code on the server, potentially compromising the entire WordPress site.

References