What is the CVSS score of CVE-2026-11912?

CVE-2026-11912 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Simple File List CVE-2026-11912

EUVD-2026-38105 HIGH

Missing Authorization (CWE-862)

2026-06-20 Wordfence

GHSA-h7pv-3jqw-7hgc

WordPress Authentication Bypass Simple File List Wordpress Plugin Eemitch

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable WordPress plugin endpoint, no auth or interaction (PR:N/UI:N/AC:L); file deletion yields I:H and A:H by destroying site files, C:N as no read primitive is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 7.5

Analysis Generated

Jun 22, 2026 - 05:50 vuln.today

DescriptionCVE.org

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.

AnalysisAI

Arbitrary file modification and deletion in the Simple File List WordPress plugin (versions up to and including 6.3.7) allows unauthenticated remote attackers to alter or remove files on the server. The flaw stems from a broken authorization guard where an is_admin() check short-circuits before the AllowFrontManage setting is evaluated, leaving every installation exposed regardless of configuration. No public exploit identified at time of analysis, but the bug is reachable on default settings and was disclosed by Wordfence.

Technical ContextAI

Simple File List is a WordPress plugin by 'eemitch' (CPE cpe:2.3:a:eemitch:simple_file_list) that lets site operators publish a browsable directory of uploaded files. The vulnerability is a CWE-862 Missing Authorization: the plugin's front-end management guard relies on WordPress's is_admin() function, which only reports whether the current request targets the wp-admin area - it is not an authentication or capability check. Because the guard returns early on that condition, the subsequent AllowFrontManage configuration check (which the administrator may intentionally have left disabled) is never evaluated, and the file deletion / modification handlers in includes/ee-functions.php and simple-file-list.php execute for any caller, including anonymous requests to front-end endpoints.

RemediationAI

Upstream fix available (changeset 3579098 on the plugin's trac repository); a released patched version greater than 6.3.7 is not independently confirmed in the supplied data, so administrators should update Simple File List to the latest version published on the WordPress plugin repository as soon as it is available and verify via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/509a40d2-a33a-49ba-b858-fa8805127a1b). Until a tagged release is installed, deactivate and remove the Simple File List plugin entirely - this is the only reliable mitigation because the guard is broken regardless of the AllowFrontManage setting, so toggling that option will NOT block exploitation; deactivation removes the file list functionality from public-facing pages. As a network-layer compensating control, block unauthenticated POST requests to the plugin's front-end AJAX action handlers (eeSFL_* actions in admin-ajax.php) via a WAF rule, accepting the trade-off that legitimate front-end uploads will also be blocked.