What is the CVSS score of CVE-2026-11911?

CVE-2026-11911 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Simple File List CVE-2026-11911

EUVD-2026-38106 HIGH

Path Traversal (CWE-22)

2026-06-20 Wordfence

GHSA-48xh-7hj4-29c9

PHP WordPress RCE Path Traversal Simple File List Wordpress Plugin Eemitch

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network-reachable AJAX endpoint (AV:N/AC:L/PR:N/UI:N); arbitrary file deletion directly impacts integrity and availability (I:H/A:H), with no direct confidentiality disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 7.5

Analysis Generated

Jun 22, 2026 - 05:50 vuln.today

DescriptionCVE.org

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint.

AnalysisAI

Unauthenticated arbitrary file deletion in the Simple File List WordPress plugin (versions up to and including 6.3.7) allows remote attackers to delete any file the web server can write to, including wp-config.php, which can escalate to remote code execution. The flaw lives in the eeSFL_DeleteFile function and is reachable via the simplefilelist_edit_job AJAX action registered through wp_ajax_nopriv_, with the is_admin() guard rendered ineffective because that function always returns true on admin-ajax.php. No public exploit identified at time of analysis, but the trivial reachability and high-value target (WordPress) make weaponization straightforward.

Technical ContextAI

Simple File List is a popular WordPress plugin by author 'eemitch' for managing file uploads/downloads, identified by CPE cpe:2.3:a:eemitch:simple_file_list. The bug is a textbook CWE-22 (Path Traversal) in eeSFL_DeleteFile: user-supplied file path input is passed to a delete operation without normalization or containment to the plugin's upload directory, allowing traversal sequences (e.g., ../../) to escape into the WordPress root or beyond. Compounding the issue is a WordPress-specific authentication pitfall: handlers registered with wp_ajax_nopriv_ are intentionally exposed to unauthenticated requests, and developers commonly rely on is_admin() as a secondary guard - but is_admin() in WordPress only checks whether the request targets wp-admin/ (which admin-ajax.php does), not whether the caller is authenticated, so the check is a no-op here.

RemediationAI

Upstream fix available (commit/changeset 3579098 in the simple-file-list plugin trac at https://plugins.trac.wordpress.org/changeset?old=3579098%40simple-file-list&new=3579098%40simple-file-list); a released patched version beyond 6.3.7 is not independently confirmed in the provided data, so administrators should upgrade to the latest plugin release published after 6.3.7 once available and consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/748c4ca8-fcbf-43e5-ab70-721e83253663) for the fixed version number. If upgrading immediately is not possible, deactivate and remove the Simple File List plugin entirely (this removes the AJAX handler registration and eliminates the attack surface, at the cost of losing the plugin's file-listing functionality), or block unauthenticated POST requests to /wp-admin/admin-ajax.php where action=simplefilelist_edit_job at a WAF or reverse proxy (Wordfence, Cloudflare, or nginx rule) - note this is action-specific and will not affect other AJAX handlers but must be enforced before WordPress processes the request. Ensure file system permissions prevent the web server user from writing outside wp-content/uploads/ as defense-in-depth, though this will not fully mitigate deletion of WordPress core/config files which the web server typically can write.