CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/

Configurations

No configuration.

History

22 Oct 2026, 16:09

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress Simple File List hasta la versión 6.3.11 no valida la ruta de origen de una operación de movimiento de archivos accesible por usuarios no autenticados, permitiéndoles leer archivos arbitrarios en el servidor y reubicar archivos críticos fuera de la raíz web, lo que lleva a la revelación de información sensible y una posible toma de control del sitio.

Information

Published : 2026-08-19 06:17

Updated : 2026-10-22 16:09

NVD link : CVE-2026-16616

Mitre link : CVE-2026-16616

CVE.ORG link : CVE-2026-16616

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-16616", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16616", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T17:40:20.821313Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Simple File List", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.3.11"}], "defaultStatus": "unknown"}]}], "published": "2026-08-19T06:17:35.210", "references": [{"url": "https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover."}, {"lang": "es", "value": "El plugin de WordPress Simple File List hasta la versi\u00f3n 6.3.11 no valida la ruta de origen de una operaci\u00f3n de movimiento de archivos accesible por usuarios no autenticados, permiti\u00e9ndoles leer archivos arbitrarios en el servidor y reubicar archivos cr\u00edticos fuera de la ra\u00edz web, lo que lleva a la revelaci\u00f3n de informaci\u00f3n sensible y una posible toma de control del sitio."}], "lastModified": "2026-10-22T16:09:59.560", "sourceIdentifier": "contact@wpscan.com"}