CVE-2026-11912 Overview
The Simple File List plugin for WordPress contains a missing authorization vulnerability [CWE-862] affecting all versions up to and including 6.3.7. Unauthenticated attackers can delete and modify files on the server because the is_admin() check unconditionally short-circuits the authorization guard before the AllowFrontManage setting is evaluated. The flaw is exploitable even when administrators have not enabled front-end file management, making default installations vulnerable. The vulnerability impacts site integrity by allowing attackers to tamper with arbitrary files accessible to the plugin.
Critical Impact
Unauthenticated remote attackers can modify and delete files on WordPress sites running the Simple File List plugin, leading to defacement, content tampering, or destruction of plugin-managed data.
Affected Products
- Simple File List plugin for WordPress — all versions through 6.3.7
- WordPress sites with the plugin installed, regardless of AllowFrontManage setting
- Hosting environments exposing affected WordPress instances to the network
Discovery Timeline
- 2026-06-20 - CVE-2026-11912 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-11912
Vulnerability Analysis
The Simple File List plugin exposes file management actions through WordPress AJAX endpoints. The plugin's authorization guard relies on the WordPress is_admin() function to determine whether a request originates from an administrative context. This function returns true for any request targeting wp-admin/admin-ajax.php, including unauthenticated requests, so it does not verify user identity or capability.
Because the guard short-circuits on is_admin() before evaluating the AllowFrontManage configuration option, unauthenticated callers reach file-modification routines directly. The affected code paths are referenced in includes/ee-functions.php (lines 880, 1265, 1586), includes/ee-list-display.php (line 473), and simple-file-list.php (line 262). Attackers can invoke delete and modify operations against files the plugin tracks.
Root Cause
The root cause is improper use of is_admin() as an authorization check. WordPress documentation explicitly warns that is_admin() only reports whether the request targets the admin area, not whether the requester is authenticated or privileged. The plugin needed an explicit capability check such as current_user_can('manage_options') combined with a verified nonce.
Attack Vector
An unauthenticated attacker sends a crafted HTTP POST request to the plugin's AJAX action. The request reaches the vulnerable handler in ee-functions.php, where the missing capability check allows the file delete or modify operation to execute against paths controlled by the plugin. No user interaction or prior authentication is required.
No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress plugin source for the affected code paths.
Detection Methods for CVE-2026-11912
Indicators of Compromise
- Unexpected POST requests to wp-admin/admin-ajax.php referencing Simple File List actions from unauthenticated sessions
- Modified or deleted files in directories managed by the Simple File List plugin (typically under wp-content/uploads/simple-file-list/)
- Web server access logs showing repeated AJAX action calls without an authenticated wordpress_logged_in_* cookie
Detection Strategies
- Inventory all WordPress installations and identify sites running Simple File List version 6.3.7 or earlier
- Compare current files in plugin-managed directories against known-good backups to identify tampered content
- Review WordPress audit logs and web server logs for AJAX requests targeting plugin actions outside administrator workflows
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress wp-content directory to alert on unauthorized changes
- Forward web server access logs to a centralized log platform and alert on bursts of AJAX requests without authentication cookies
- Monitor outbound network connections from the web server for signs of follow-on activity after file modification
How to Mitigate CVE-2026-11912
Immediate Actions Required
- Update the Simple File List plugin to a fixed version above 6.3.7 as soon as the vendor releases one
- If a fixed version is not yet available, deactivate and remove the Simple File List plugin from affected sites
- Audit plugin-managed directories for unauthorized file changes and restore from clean backups where tampering is detected
Patch Information
The vendor change history is available in the WordPress plugin changeset. Administrators should apply the latest plugin release that contains a proper capability check and nonce verification in the affected handlers.
Workarounds
- Block external access to wp-admin/admin-ajax.php actions associated with the Simple File List plugin using a web application firewall rule
- Restrict write permissions on the plugin's upload directory at the filesystem level to reduce the impact of unauthorized modifications
- Disable the plugin until a patched release is installed if the file listing feature is not business-critical
# Example: deactivate the Simple File List plugin via WP-CLI
wp plugin deactivate simple-file-list
wp plugin delete simple-file-list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
