CVE-2026-12119: WordPress Simple File List Auth Bypass

CVE-2026-12119 Overview

CVE-2026-12119 affects the Simple File List plugin for WordPress in all versions up to and including 6.3.7. The vulnerability stems from a missing authorization check on the frontmanage shortcode attribute. Authenticated users with contributor-level access or above can perform arbitrary file operations including deletion, move, folder creation, and download. The issue resides in includes/ee-list-ops-bar-process.php, where intended authorization checks are bypassed. This vulnerability is categorized under [CWE-862] Missing Authorization.

Critical Impact
Contributor-level attackers can delete, move, download, or create files and folders managed by the plugin, leading to integrity loss and potential data destruction on affected WordPress sites.

Affected Products

Simple File List plugin for WordPress, all versions through 6.3.7
WordPress installations that expose the eeSFL shortcode via posts or pages
Sites permitting contributor or higher roles to author content

Discovery Timeline

2026-06-20 - CVE-2026-12119 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12119

Vulnerability Analysis

The Simple File List plugin renders a front-end file management interface when a post contains the eeSFL shortcode with the frontmanage attribute enabled. The plugin generates a nonce to authorize subsequent file operations submitted through the operations bar. However, the request handler in includes/ee-list-ops-bar-process.php does not enforce role-based authorization beyond nonce verification.

This design allows any authenticated user who can render the shortcode to invoke privileged file operations. Operations exposed by the endpoint include file deletion, file move, folder creation, and file download. Contributors are not normally permitted to manage uploaded files outside their own attachments, so this represents an authorization boundary violation.

Root Cause

The root cause is a missing capability check. The handler validates that the request carries a valid nonce but does not verify that the requesting user holds a role permitted to manage files. Because nonces in WordPress are not access control mechanisms, possession of a valid nonce should not be treated as authorization. See the WordPress Plugin Ops Bar Process Code for the affected logic.

Attack Vector

An attacker with contributor access creates a draft post containing the eeSFL shortcode with the frontmanage attribute set. The attacker renders the draft through the post preview endpoint, which executes the shortcode and emits a valid nonce within the generated markup. The attacker harvests this nonce and submits authenticated POST requests to the operations endpoint with action parameters for delete, move, mkdir, or download. The server processes these requests against the plugin's storage directory without verifying the user's role. Additional context is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-12119

Indicators of Compromise

Draft posts authored by contributor-level accounts containing the eeSFL shortcode with a frontmanage attribute
Post preview requests followed by POST requests to plugin operation handlers under wp-content/plugins/simple-file-list/
Unexpected deletions, renames, or new directories within the Simple File List upload path
Download activity from contributor accounts targeting files outside their own attachments

Detection Strategies

Review WordPress audit logs for shortcode rendering events tied to non-administrative roles
Correlate post_preview actions with subsequent file operation POSTs from the same session
Alert on file system changes within the plugin's managed directories that lack a corresponding administrator action

Monitoring Recommendations

Enable WordPress activity logging for content authoring and file operations
Capture web server access logs for requests to plugin endpoints in includes/ee-list-ops-bar-process.php
Monitor integrity of upload directories using file integrity monitoring tooling
Track creation of draft posts by contributors that include shortcodes referencing file management

How to Mitigate CVE-2026-12119

Immediate Actions Required

Update the Simple File List plugin to a version newer than 6.3.7 once available from the vendor
Audit existing draft and published posts for the eeSFL shortcode authored by non-administrators
Restrict contributor and author roles from previewing posts containing the affected shortcode where feasible
Back up plugin-managed file directories before remediation in case rollback is required

Patch Information

The vendor published a fix tracked in the WordPress Plugin Changeset Details. Site administrators should upgrade to the patched release distributed through the WordPress plugin repository. Verify the installed version through the WordPress admin Plugins screen after applying the update.

Workarounds

Deactivate the Simple File List plugin until the patched version is installed
Remove or disable any posts and pages containing the eeSFL shortcode
Limit contributor-level account creation and review existing low-privilege accounts for anomalous activity
Apply Web Application Firewall rules to block requests targeting ee-list-ops-bar-process.php from non-administrative sessions

bash

# Disable the plugin via WP-CLI pending upgrade
wp plugin deactivate simple-file-list

# List posts containing the vulnerable shortcode for review
wp post list --post_status=any --s='[eeSFL' --fields=ID,post_author,post_status,post_title