CVE-2026-11911

Name of the Vulnerable Software and Affected Versions Simple File List versions prior to 6.3.8

Description The Simple File List plugin for WordPress contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation within the eeSFL DeleteFile() function, specifically involving the eeSubFolder parameter. The issue is accessible via the 'simplefilelist edit job' AJAX action, which is registered for non-privileged users. The is admin() security guard is bypassed because it returns true for all requests sent to the 'admin-ajax.php' endpoint. Deleting critical files, such as 'wp-config.php', can lead to remote code execution (the ability to execute arbitrary commands on the target machine).

Recommendations Update to a version later than 6.3.7. As a temporary workaround, restrict access to the 'admin-ajax.php' endpoint or the 'simplefilelist edit job' action to minimize the risk of exploitation.