CVE-2026-16616
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 19, 2026
- Updated
- Aug 19, 2026
- Reserved
- Jul 22, 2026
Description
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Simple File ListUnknown |
|
References
- https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.