High severity · published Aug 19, 2026
CVE-2026-16616
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
8.6
CVSS
0.7%
EPSS
No
On KEV
Description
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Simple File List ·
through 6.3.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16616
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16616
wpscan.com
https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/
More from Simple File List
8.8
CVE-2026-16617
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
6.5
CVE-2022-3208
Simple File List < 4.4.13 - Page Creation via CSRF
5.4
CVE-2024-10146
Simple File List < 6.1.13 - Reflected Cross-Site Scripting
4.8
CVE-2022-3207
Simple File List < 4.4.12 - Admin+ Stored Cross-Site Scripting