PT-2025-29315 · WordPress · Simple-File-List Plugin

Coiffeur

·

CVE-2020-36847

·

Published

2020-04-19

·

Updated

2026-08-21

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Simple-File-List Plugin for WordPress versions through 4.2.2
Description: The Simple-File-List Plugin for WordPress is susceptible to Remote Code Execution via the rename function. This allows unauthenticated attackers to execute code on the server by renaming uploaded PHP code with a PNG extension to use a PHP extension.
Recommendations: Update the Simple-File-List Plugin for WordPress to version 4.2.3 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2026-11290
CVE-2020-36847

Affected Products

Simple-File-List Plugin