CVE-2026-11912

Name of the Vulnerable Software and Affected Versions Simple File List versions prior to 6.3.8

Description The Simple File List plugin for WordPress contains insufficient authorization checks that allow unauthenticated attackers to delete and modify files on the server. This issue occurs within the simplefilelist edit job AJAX action. The flaw persists even if the AllowFrontManage setting is disabled because the is admin() function unconditionally bypasses the security guard before the setting is evaluated.

Recommendations Update the plugin to a version later than 6.3.7.