Unauthorized File Operations in Simple File List for WordPress

CVE-2026-12119

What is CVE-2026-12119?

The Simple File List plugin for WordPress contains a vulnerability due to a lack of proper authorization checks on the 'frontmanage' shortcode attribute. This flaw allows authenticated attackers with contributor-level access and higher to execute unauthorized file operations such as deletion, movement, folder creation, and downloads. Attackers can exploit this vulnerability by creating draft posts that include the 'eeSFL' shortcode, utilizing the post preview endpoint to retrieve the nonce necessary for authorization, and subsequently issuing file operation requests that bypass the intended security measures found in the plugin's core files.

References