Arbitrary File Modification in Simple File List Plugin for WordPress

CVE-2026-11912

What is CVE-2026-11912?

The Simple File List plugin for WordPress contains a security flaw that permits arbitrary file modification due to a lack of adequate authorization checks. Attackers can exploit this vulnerability to delete or modify files on the server even in scenarios where the administrator has not activated the AllowFrontManage setting. This occurs because the is_admin() function fails to assess access rights properly, allowing unauthorized access to critical file management functionalities in all versions up to and including 6.3.7.

References