CVE-2020-36847: The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a pn

critical Affects simple-file-list (WordPress plugin). Feed 2026.10.29.3, updated 2026-10-29; published 2025-07-12; advisory modified 2026-06-17.

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a pn

Package: simple-file-list (WordPress plugin) WordPress
Affected versions: <4.2.3
Fixed in: 4.2.3
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 44% (98.7th percentile)
Published: 2025-07-12
Source: nvd

References

CWE-434

NVD record simple-file-list (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-3062 medium The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outp same package: simple-file-list (WordPress plugin)
CVE-2022-1119 high The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeF same package: simple-file-list (WordPress plugin)
CVE-2020-12832 critical WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attac same package: simple-file-list (WordPress plugin)
CVE-2024-10146 medium The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generat same package: simple-file-list (WordPress plugin)
CVE-2022-3207 medium The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of i same package: simple-file-list (WordPress plugin)
CVE-2023-1025 medium The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of i same package: simple-file-list (WordPress plugin)