EUVD-2020-30797Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 86.1%, PoC available, patch available. The two-step attack chain is reliable and automated in exploit frameworks. Simple File List is installed on thousands of WordPress sites for file sharing functionality, which inherently means the file directory is web-accessible. |
| Exploit ScenarioDerived | An attacker uploads shell.png containing PHP code through the Simple File List upload form. They then send a POST request to the rename endpoint: rename shell.png to shell.php. Accessing /wp-content/uploads/simple-file-list/shell.php provides a webshell with the web server's privileges. The attacker dumps wp-config.php credentials and pivots to the database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions.
Earlier versions of this analysis (1)
Two-step RCE in Simple File List WordPress plugin: upload PHP as PNG, then rename to PHP using the plugin's own rename function.
RemediationAI
Update to Simple File List 4.2.3 or later. Configure the web server to deny PHP execution in the plugin's upload directory. Review the upload directory for suspicious PHP files. Add authentication requirements to file management operations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin allows file uploads with extension validation that blocks .php files. However, the rename function is accessible without authentication and performs no extension checks. An attacker uploads a PHP webshell with a .png extension (passing upload validation), then sends a rename request to change the extension from .png to .php. The file is now executable and accessible via the web.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Executive ViewAI
A critical vulnerability in the Simple-File-List WordPress plugin allows unauthenticated attackers to execute arbitrary code on affected servers. Any organization running this plugin on versions 4.2.2 or earlier faces immediate risk of system compromise, data breach, and operational disruption.
Apply vendor patch. If immediate patching is not possible: (1) Disable the Simple-File-List plugin entirely, (2) Restrict file upload functionality at the WAF level, (3) Implement IP-based access restrictions to WordPress admin areas, (4) Monitor for suspicious file creation/modification events in upload directories, (5) Deploy Web Application Firewall rules to block requests to the vulnerable rename function.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC