CVE-2025-47450: Simple File List Auth Bypass Vulnerability

CVE-2025-47450 Overview

CVE-2025-47450 is a Missing Authorization vulnerability [CWE-862] in the Simple File List plugin for WordPress by Mitchell Bennis. The flaw affects all versions up to and including 6.1.13. Attackers can exploit incorrectly configured access control security levels to modify plugin settings without proper authorization checks. The vulnerability is network-exploitable, requires no privileges, and requires no user interaction. It affects the integrity of plugin configuration while leaving confidentiality and availability intact.

Critical Impact
Unauthenticated attackers can alter Simple File List plugin settings on affected WordPress sites, potentially weakening file upload restrictions or exposing hosted files.

Affected Products

Mitchell Bennis Simple File List WordPress plugin
All versions from n/a through 6.1.13
WordPress sites with the simple-file-list plugin installed and active

Discovery Timeline

2025-05-07 - CVE CVE-2025-47450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47450

Vulnerability Analysis

The vulnerability stems from a missing authorization check in the Simple File List plugin. The plugin exposes settings-modification functionality without verifying that the requesting user holds the appropriate capability or role. This allows any unauthenticated network user to submit settings-change requests directly to the plugin's endpoints. Because the plugin controls file listing and upload behavior on WordPress sites, altered settings can degrade the integrity of the file management workflow. The issue is classified under [CWE-862] Missing Authorization.

Root Cause

The root cause is an incorrectly configured access control security level on one or more plugin actions. Sensitive settings handlers do not call WordPress capability checks such as current_user_can() or validate a nonce via check_admin_referer(). Without these guards, the plugin treats requests from any origin as authorized. This design flaw makes state-changing operations reachable by users with no session or privilege on the target site.

Attack Vector

An attacker sends crafted HTTP requests to the plugin's settings endpoints on a vulnerable WordPress installation. No authentication, tokens, or user interaction are required. Successful requests modify plugin configuration values, which may include allowed file types, upload paths, or visibility settings. The change can then be leveraged to widen the attack surface, such as enabling upload of previously blocked file types. Full technical details are available in the Patchstack advisory for Simple File List.

No verified public exploit code is available at this time. The vulnerability is described in prose based on the vendor advisory; readers should consult the Patchstack WordPress Vulnerability database entry for additional technical context.

Detection Methods for CVE-2025-47450

Indicators of Compromise

Unexpected changes to Simple File List plugin settings recorded in the WordPress database (wp_options table).
HTTP POST requests to simple-file-list admin-ajax or plugin endpoints originating from unauthenticated sessions.
New or modified file type allowlists in the plugin configuration that were not made by an administrator.
Anomalous uploads appearing in directories managed by the plugin after settings modifications.

Detection Strategies

Enable WordPress audit logging to capture changes to plugin options and administrator actions.
Monitor web server access logs for POST requests targeting simple-file-list endpoints without valid authenticated cookies.
Compare plugin configuration snapshots over time to identify unauthorized modifications.
Alert on inbound requests to /wp-admin/admin-ajax.php referencing Simple File List actions from unauthenticated sources.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized log platform for correlation and retention.
Track file uploads into plugin-managed directories and flag file types outside the historical baseline.
Review plugin version inventory across managed WordPress properties to identify installations at or below version 6.1.13.

How to Mitigate CVE-2025-47450

Immediate Actions Required

Update the Simple File List plugin to a version released after 6.1.13 that includes the vendor's authorization fix.
Audit current plugin settings and revert any unauthorized changes to a known-good configuration.
Restrict administrative access to WordPress by enforcing strong authentication and limiting admin IP ranges where feasible.
Review upload directories for unexpected files and remove any content that cannot be attributed to legitimate users.

Patch Information

Refer to the Patchstack advisory for Simple File List for the fixed version and remediation guidance from the plugin author. Apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release.

Workarounds

Deactivate and remove the Simple File List plugin until a patched version can be deployed.
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated POST requests to Simple File List settings endpoints.
Restrict access to /wp-admin/ paths using server-level authentication or IP allowlisting where practical.

bash

# Configuration example: block unauthenticated access to plugin admin-ajax actions at the web server layer
# Example nginx rule
location ~* /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^(ee_upload_file|eeSFL_)") {
        return 403;
    }
}