vulnerability
WordPress Plugin: simple-file-list: CVE-2023-44227: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:N/C:N/I:C/A:C) | Sep 28, 2023 | May 15, 2025 | Jul 10, 2025 |
Severity
9
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:C)
Published
Sep 28, 2023
Added
May 15, 2025
Modified
Jul 10, 2025
Description
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including, 6.1.9. This is due to insufficient controls on files passed to a deletion function. This makes it possible for unauthenticated attackers to delete arbitrary files, which can lead to a denial of service or remote code execution when the wp-config.php file is deleted.
Solution
simple-file-list-plugin-cve-2023-44227
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.