What is the CVSS score of CVE-2026-12119?

CVE-2026-12119 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Simple File List CVE-2026-12119

EUVD-2026-38107 MEDIUM

Missing Authorization (CWE-862)

2026-06-20 Wordfence

GHSA-45x9-67jx-vx44

PHP WordPress Authentication Bypass Simple File List Wordpress Plugin Eemitch

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.6 HIGH

PR:L confirmed by contributor requirement; C:L added for documented download capability; A:L reflects indirect availability risk from arbitrary file deletion.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:13 vuln.today

CVE Published

Jun 20, 2026 - 08:29 nvd

MEDIUM 6.5

DescriptionCVE.org

The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php.

AnalysisAI

Unauthorized file operations in the Simple File List WordPress plugin (versions through 6.3.7) allow authenticated contributors to delete, move, create folders, and download arbitrary server files by exploiting a missing authorization check on the 'frontmanage' shortcode attribute. The attack is non-trivial but fully described: an attacker creates a draft post embedding the 'eeSFL' shortcode, loads the WordPress post preview endpoint to harvest a valid nonce, then submits file operation requests to ee-list-ops-bar-process.php that bypass the intended privilege checks. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a patch changeset (3579098) exists in the plugin repository, though the released fixed version is not independently confirmed.

Technical ContextAI

Simple File List is a PHP-based WordPress plugin by eemitch (CPE: cpe:2.3:a:eemitch:simple_file_list:*:*:*:*:*:*:*:*) providing frontend file management via the 'eeSFL' shortcode. The root cause is CWE-862 (Missing Authorization): the 'frontmanage' shortcode attribute triggers file operation processing in includes/ee-list-ops-bar-process.php (line 50) without verifying the requesting user holds sufficient privileges beyond a valid WordPress nonce. WordPress nonces validate request authenticity - they are not authorization tokens - yet the plugin treats nonce possession as sufficient proof of permission. The vulnerability is multi-file: ee-front-end.php (line 140) renders the shortcode in preview contexts, ee-list-ops-bar-display.php (line 25) exposes the nonce in the HTML output, and ee-list-display.php (line 341) participates in the frontend rendering pipeline. WordPress's post preview endpoint intentionally renders draft post content for the authoring user, which is the mechanism exploited to obtain the nonce without publishing content.

RemediationAI

Upstream fix available via plugin repository changeset 3579098 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579098%40simple-file-list&new=3579098%40simple-file-list); however, the specific patched release version number is not confirmed in the available data - administrators should update to the latest version available in the WordPress plugin directory and verify the installed version exceeds 6.3.7. If immediate patching is not feasible, restricting the WordPress contributor role from creating posts (via a role management plugin) eliminates the draft-post-to-nonce-harvest attack path, at the cost of impacting normal contributor workflows. Alternatively, disabling the Simple File List plugin entirely until patching is complete removes all exposure without side effects beyond the loss of frontend file management functionality. Administrators should audit whether any untrusted users hold contributor-level access or above, as this is the minimum privilege required to exploit this issue. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ed51a3-c049-4816-ada1-49f7edcb9a6f provides additional remediation detail.