CVE-2026-12119
Received Received - Intake
Unauthorized File Operations in Simple File List WordPress Plugin

Publication date: 2026-06-20

Last updated on: 2026-06-20

Assigner: Wordfence

Description
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-20
Last Modified
2026-06-20
Generated
2026-06-20
AI Q&A
2026-06-20
EPSS Evaluated
N/A
NVD
CVE-2026-12119
EUVD
EUVD-2026-38107
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
simple_file_list plugin to 6.3.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Simple File List plugin for WordPress has a vulnerability due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to and including 6.3.7.

This flaw allows authenticated users with contributor-level access or higher to perform unauthorized file operations such as deleting, moving, creating folders, and downloading files.

An attacker can exploit this by creating a draft post containing a specific shortcode ('eeSFL'), previewing the post to obtain a necessary nonce (authorization token), and then submitting file operation requests that bypass the intended security checks.

Impact Analysis

This vulnerability can lead to unauthorized manipulation of files on your WordPress site by users who should not have such permissions.

  • Attackers with contributor-level access or above can delete important files.
  • They can move files or create new folders, potentially disrupting site structure or content.
  • They can download files, which may lead to data leakage.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart