CVE-2026-12119

Deferred Deferred - Pending Action

Unauthorized File Operations in Simple File List WordPress Plugin

Publication date: 2026-06-20

Last updated on: 2026-06-22

Assigner: Wordfence

Description

The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-20

Last Modified

2026-06-22

Generated

2026-07-10

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-09

NVD

CVE-2026-12119

EUVD

EUVD-2026-38107

Affected Vendors & Products

Vendor	Product	Version / Range
simple_file_list	plugin	to 6.3.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Simple File List plugin for WordPress has a vulnerability due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to and including 6.3.7.

This flaw allows authenticated users with contributor-level access or higher to perform unauthorized file operations such as deleting, moving, creating folders, and downloading files.

An attacker can exploit this by creating a draft post containing a specific shortcode ('eeSFL'), previewing the post to obtain a necessary nonce (authorization token), and then submitting file operation requests that bypass the intended security checks.

Impact Analysis

This vulnerability can lead to unauthorized manipulation of files on your WordPress site by users who should not have such permissions.

Attackers with contributor-level access or above can delete important files.
They can move files or create new folders, potentially disrupting site structure or content.
They can download files, which may lead to data leakage.

Hi! I’m here to help you understand CVE-2026-12119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70