CVE-2026-16616: Simple File List WordPress Plugin Vulnerability

CVE-2026-16616 Overview

CVE-2026-16616 affects the Simple File List WordPress plugin through version 6.3.11. The plugin fails to validate the source path of a file-move operation exposed to unauthenticated users. Attackers can read arbitrary files on the server and relocate critical files outside the web root. Successful exploitation leads to sensitive information disclosure and potential site takeover.

The flaw is classified as a path traversal weakness [CWE-22]. It is reachable over the network without authentication or user interaction. The vulnerability carries a scope-changed impact because file relocation affects resources beyond the plugin's own security boundary.

Critical Impact
Unauthenticated attackers can read sensitive files such as wp-config.php and move core WordPress files, breaking site integrity and enabling full compromise.

Affected Products

Simple File List WordPress plugin versions up to and including 6.3.11
WordPress sites with the plugin activated and reachable over the network
Any hosting environment where the plugin's move endpoint is exposed to unauthenticated requests

Discovery Timeline

2026-08-19 - CVE-2026-16616 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-16616

Vulnerability Analysis

The Simple File List plugin exposes a file-move handler that accepts a source path from client input. The handler does not validate or canonicalize the source path against an allowlisted directory. An unauthenticated attacker can supply relative traversal sequences such as ../ to reference files outside the plugin's upload directory.

Because the move operation preserves file contents at the destination, attackers can relocate any file readable by the web server into a publicly accessible directory and retrieve it. The same primitive enables attackers to move critical files, such as wp-config.php or plugin PHP files, out of the web root. Relocating configuration or core files disrupts site operation and can leak database credentials and authentication secrets.

Root Cause

The root cause is missing input validation on the source parameter of the move operation [CWE-22]. The plugin does not restrict traversal characters, does not resolve the absolute path, and does not verify that the resolved path stays within an intended base directory. The endpoint also lacks authentication and capability checks, allowing anonymous requests to trigger the vulnerable code path.

Attack Vector

Exploitation requires a single HTTP request to the plugin's move endpoint. The attacker supplies a crafted source path containing directory traversal sequences and a destination path within the plugin's web-accessible directory. The server executes the move, and the attacker downloads the relocated file. See the WPScan Vulnerability Advisory for advisory details.

No verified public exploit code is available at the time of publication. No synthetic exploit code is provided here; refer to the linked advisory for technical specifics.

Detection Methods for CVE-2026-16616

Indicators of Compromise

HTTP POST requests to Simple File List AJAX endpoints containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in source path parameters
Unexpected relocation of wp-config.php, .htaccess, or plugin PHP files from their canonical locations
New or moved files appearing under the plugin's uploads directory with names matching sensitive server files
Web server access logs showing unauthenticated requests to plugin action handlers followed by GET requests for the moved files

Detection Strategies

Inspect WordPress request logs for POST parameters referencing paths outside the plugin's upload directory
Monitor file integrity on wp-config.php and core WordPress files; alert on unexpected moves or deletions
Deploy web application firewall rules that block traversal patterns targeting Simple File List endpoints
Correlate anonymous requests to plugin endpoints with subsequent downloads of PHP or configuration files

Monitoring Recommendations

Enable verbose access logging for the WordPress /wp-content/plugins/simple-file-list/ path
Alert on any process writing to or moving wp-config.php outside of administrative maintenance windows
Track outbound traffic patterns from the WordPress host that suggest exfiltration of configuration data

How to Mitigate CVE-2026-16616

Immediate Actions Required

Deactivate the Simple File List plugin until a fixed version is confirmed installed
Rotate WordPress database credentials, salts, and API keys if the plugin was exposed to the internet
Restore any relocated files from backup and verify integrity of wp-config.php and core files
Restrict access to the WordPress admin and plugin AJAX endpoints via IP allowlisting or authentication proxies

Patch Information

A fixed version beyond 6.3.11 should be applied once released by the plugin maintainer. Consult the WPScan Vulnerability Advisory for current patch status and the vendor's WordPress.org plugin page for the latest release.

Workarounds

Remove the plugin entirely if a patched version is not yet available
Block requests to the plugin's move handler at the web application firewall until patched
Enforce filesystem permissions that prevent the web server user from writing outside designated upload directories

bash

# Web server rule example: block traversal patterns targeting the plugin
# (nginx location block)
location ~* /wp-content/plugins/simple-file-list/ {
    if ($args ~* "\.\./|%2e%2e") {
        return 403;
    }
}