Simple File List CVE-2026-39792

Requires only that the vulnerable Simple File List plugin (version 6.3.11 or earlier) is installed and active on a network-reachable WordPress site; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are needed. The limiting factors are therefore narrow: exploitation depends on the specific plugin being present and its file-handling endpoint being reachable, and on target files being deletable by the web server's user context. Impact severity in practice depends on which files the attacker targets (e.g. deleting wp-config.php is far more damaging than deleting an uploaded asset).

This is a genuine high-priority issue for WordPress sites running the affected plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description's 'Unauthenticated' label: network-reachable, low complexity, no privileges and no user interaction, meaning a remote attacker can trigger it directly against a default-reachable endpoint. The scope change (S:C) plus A:H reflects that a path-traversal file deletion (CWE-22) can reach files outside the plugin's own directory, and deleting a file such as wp-config.php can effectively take a WordPress site offline or force it into a reinstall state. The main mitigating signal is the absence of exploitation evidence: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is not yet confirmed as actively exploited. Note that the official vector records I:N despite the vulnerability being an arbitrary file *deletion*, which is arguably an integrity impact as well as an availability one - defenders should treat the destructive potential as broader than A:H alone implies. Overall: real, easily exploitable flaw worth prompt patching, but currently rated on theoretical ease rather than observed in-the-wild activity.

A remote, unauthenticated attacker sends a crafted HTTP request to the Simple File List plugin's file-handling endpoint on a target WordPress site, supplying a traversal sequence (e.g. ../../) in a filename parameter. Because no authentication or user interaction is required, the request deletes an arbitrary file outside the plugin's intended directory - for example wp-config.php - disrupting or disabling the site. No public exploit code was identified in the provided data, but the low attack complexity makes weaponization straightforward.