CVE-2026-16616 — Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

CVE-2026-16616

Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal PUBLISHED

Description (CNA)

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

Affected (CNA)

Vendor / product	Versions
Unknown / Simple File List	affected 0 through 6.3.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.