WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File Deletion

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Mitchell Bennis/Simple File List (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Mitchell Bennis/Simple File List.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Apr 17, 2024

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 12, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 12, 2026

Sources and claim methodology

• Source referencepatchstack.com

Related CVEs

• coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorizationAlso CWE-862
• Missing Authorization in Kibana Leading to Unauthorized Deletion of DataAlso CWE-862
• capgo through 12.128.2 IDOR via PUT /app icon endpointSame generic ecosystem
• Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch DriverSame generic ecosystem
• Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driverSame generic ecosystem
• Adminer before 6.0.2 Privileged-Port SSRF via host_port RegexSame generic ecosystem