critical9.8Public exploit code
CVE-2020-36847
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be u…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Simple File List WordPress Plugin 4.2.2 - File Upload to RCE2025-07-22 · webapps · multiple
Impact
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Simplefilelist | Simple File List | before 4.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://packetstormsecurity.com/files/160221/
- https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list
- https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/
- https://www.cybersecurity-help.cz/vdb/SB2020042711
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cve
- https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/