CVE-2026-11911: WordPress Simple File List Auth Bypass

CVE-2026-11911 Overview

The Simple File List plugin for WordPress contains an arbitrary file deletion vulnerability in the eeSFL_DeleteFile function. The flaw affects all versions up to and including 6.3.7. Unauthenticated attackers can delete arbitrary files on the server by abusing the simplefilelist_edit_job AJAX action, which is registered via wp_ajax_nopriv_. Deleting critical files such as wp-config.php can lead to remote code execution because WordPress enters setup mode when the configuration file is missing. The vulnerability is classified as path traversal [CWE-22].

Critical Impact
Unauthenticated attackers can delete arbitrary files on vulnerable WordPress sites, including wp-config.php, enabling site takeover and remote code execution.

Affected Products

WordPress Simple File List plugin versions up to and including 6.3.7
All WordPress installations with the affected plugin enabled
Any site exposing the admin-ajax.php endpoint (default WordPress behavior)

Discovery Timeline

2026-06-20 - CVE-2026-11911 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-11911

Vulnerability Analysis

The Simple File List plugin exposes file management functionality through WordPress AJAX endpoints. The eeSFL_DeleteFile function fails to properly validate user-supplied file paths before invoking deletion routines. This allows attackers to traverse outside the plugin's intended upload directory and target arbitrary files on the server filesystem.

The simplefilelist_edit_job AJAX action is registered using wp_ajax_nopriv_, which exposes it to unauthenticated requests. The plugin attempts to enforce administrative access using an is_admin() check, but this guard is ineffective. The is_admin() function returns true for any request handled by admin-ajax.php, regardless of whether the requester holds administrative privileges.

Root Cause

The root cause is a combination of insufficient path validation [CWE-22] and a misapplied authorization check. The eeSFL_DeleteFile function does not normalize or canonicalize the supplied path, allowing sequences such as ../ to escape the plugin upload directory. Compounding this, the developer relied on is_admin() for access control, a common WordPress development misconception that does not verify user capabilities.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to /wp-admin/admin-ajax.php with the action parameter set to simplefilelist_edit_job and a crafted file path parameter referencing the target file. Because no authentication is required and path validation is absent, the targeted file is deleted from the server. Deleting wp-config.php triggers WordPress's installation flow, which an attacker can complete to connect the site to an attacker-controlled database and execute arbitrary PHP code.

Technical details on the vulnerable code paths are available in the WordPress Simple File List source for eeSFL_DeleteFile and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-11911

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=simplefilelist_edit_job from unauthenticated sessions
Missing or unexpectedly modified wp-config.php files on WordPress hosts
WordPress sites unexpectedly redirecting to /wp-admin/install.php (indicates wp-config.php deletion)
Web server logs showing file path parameters containing traversal sequences such as ../

Detection Strategies

Inspect web access logs for requests to admin-ajax.php with the simplefilelist_edit_job action and abnormal file or path parameters
Monitor filesystem integrity on WordPress installations, particularly for deletions of wp-config.php, .htaccess, and plugin or theme files
Use WordPress security scanners to enumerate installed plugin versions and flag Simple File List <= 6.3.7

Monitoring Recommendations

Enable file integrity monitoring (FIM) on the WordPress document root and core configuration files
Forward web server access logs to a centralized SIEM and alert on unauthenticated POSTs to admin-ajax.php with the vulnerable action
Track outbound HTTP requests and database connections from WordPress hosts that deviate from baseline

How to Mitigate CVE-2026-11911

Immediate Actions Required

Update the Simple File List plugin to a version newer than 6.3.7 as soon as a patched release is available
If no patched version is available, deactivate and remove the plugin from all affected WordPress instances
Audit the WordPress filesystem for missing or modified core files, especially wp-config.php
Restrict access to /wp-admin/admin-ajax.php at the web application firewall (WAF) layer for the vulnerable action

Patch Information

Review the WordPress Simple File List changeset and the Wordfence Vulnerability Report for upstream remediation details. Apply the vendor patch through the WordPress plugin updater once published.

Workarounds

Block requests to admin-ajax.php where the action parameter equals simplefilelist_edit_job using a WAF rule
Apply restrictive filesystem permissions so the PHP process cannot delete files outside the plugin upload directory
Remove the plugin entirely if the file listing functionality is not business-critical

bash

# Example WAF / mod_security rule to block exploit attempts
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026119110,\
   msg:'Block CVE-2026-11911 Simple File List arbitrary file deletion'"
  SecRule ARGS:action "@streq simplefilelist_edit_job" "t:none"