CVE-2026-39792: Simple File List Path Traversal Vulnerability

CVE-2026-39792 Overview

CVE-2026-39792 is an unauthenticated arbitrary file deletion vulnerability in the Simple File List WordPress plugin, affecting versions up to and including 6.3.11. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Remote attackers can delete arbitrary files on the underlying filesystem without authentication, leading to loss of integrity for site files and potential denial of service.

Critical Impact
An unauthenticated remote attacker can delete arbitrary files on a WordPress host running Simple File List <= 6.3.11, including files such as wp-config.php, which can take sites offline or enable follow-on compromise.

Affected Products

Simple File List WordPress plugin, all versions through 6.3.11
WordPress sites with the plugin installed and network-reachable
Shared or multi-site WordPress environments where the plugin is active

Discovery Timeline

2026-10-06 - CVE-2026-39792 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-39792

Vulnerability Analysis

Simple File List provides WordPress administrators with upload and file-management features exposed through plugin endpoints. In versions up to 6.3.11, a file-deletion handler fails to properly validate the supplied filename and does not enforce authentication or capability checks. An attacker who can reach the WordPress site over the network can issue a crafted request that deletes files outside the intended managed directory.

The EPSS score for this issue is 0.36% (27.679 percentile), indicating low observed exploitation probability at publication. However, the lack of authentication combined with network reachability makes opportunistic abuse realistic once public exploit details emerge. Public details are tracked in the Patchstack WordPress Vulnerability Report.

Root Cause

The root cause is improper sanitization of a user-supplied filename parameter in the plugin's deletion routine. The handler accepts path components such as ../ and resolves them relative to the plugin's upload directory. Because the endpoint does not enforce is_user_logged_in() or a current_user_can() capability check, any unauthenticated request can traverse outside the intended folder and remove arbitrary files writable by the web server user.

Attack Vector

Exploitation requires only network access to the vulnerable WordPress site. An attacker sends a crafted HTTP request to the plugin's AJAX or REST endpoint with a filename value containing directory traversal sequences. The server resolves the path and unlinks the targeted file. Deleting wp-config.php triggers the WordPress installation flow on next request, which an attacker can use to attach the site to an attacker-controlled database and achieve remote code execution.

No verified exploit code is published alongside this advisory. The vulnerability mechanism is described in the Patchstack advisory linked above; practitioners should rely on vendor references rather than synthetic proof-of-concept code.

Detection Methods for CVE-2026-39792

Indicators of Compromise

HTTP requests to Simple File List plugin endpoints under /wp-content/plugins/simple-file-list/ containing ../ or URL-encoded traversal sequences such as %2e%2e%2f in parameters
Unexpected deletion or disappearance of WordPress core files, including wp-config.php, .htaccess, or theme and plugin PHP files
WordPress returning the installation wizard (/wp-admin/install.php) on previously configured sites
Web server error logs showing unlink() operations or 404s for files that previously existed

Detection Strategies

Enable file integrity monitoring on the WordPress document root to alert on deletions of core files and plugin assets
Inspect access logs for POST requests to Simple File List endpoints originating from unauthenticated sessions or anomalous IPs
Deploy WAF signatures that flag path traversal patterns targeting WordPress plugin paths

Monitoring Recommendations

Forward WordPress access and PHP error logs to a centralized logging platform and alert on unlink or file_delete activity tied to plugin endpoints
Baseline the inventory of files under wp-content/uploads/simple-file-list/ and alert on deletions outside normal admin activity
Monitor for sudden traffic spikes to plugin endpoints that correlate with filesystem changes

How to Mitigate CVE-2026-39792

Immediate Actions Required

Update Simple File List to a version later than 6.3.11 as soon as the vendor publishes a fixed release
If no patched version is available, deactivate and remove the plugin until a fix is released
Restore any deleted files from backup and verify integrity of wp-config.php and other WordPress core files
Rotate database credentials and WordPress salts if wp-config.php was deleted or exposed

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the latest patched version information and vendor guidance. Administrators should apply the vendor-supplied update through the WordPress plugin management interface and verify the version string after upgrade.

Workarounds

Block requests to Simple File List plugin paths at the WAF or reverse proxy until patched
Restrict access to /wp-content/plugins/simple-file-list/ by source IP where feasible
Enforce least-privilege filesystem permissions so the web server user cannot delete files outside the intended uploads directory

bash

# Example nginx snippet to block unauthenticated access to the plugin path
location ~* /wp-content/plugins/simple-file-list/ {
    allow 10.0.0.0/8;
    deny all;
}