Simple File List < 4.2.3 - Remote Code Execution
Priority HIGH 82CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.43519 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Simple File List (eemitch): 4.2.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| eemitch | Simple File List | before 4.2.3 | 4.2.3 | Patch available | CNA |
- Simple File List Vendoreemitch Affected before 4.2.3 Fixed in 4.2.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:* | before 4.2.3 | Vulnerable | Simplefilelist |
- cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:* Versions before 4.2.3 Vulnerable ·Simplefilelist
Remediation
- Fix · CNA Simple File List (eemitch) Fixed in 4.2.3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36847
- 2026-10-03 Alias added: GHSA-34hm-qhxq-8vfv
References
Exploit 2
More eemitch vulnerabilities
- TI-2026-10276 Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter CVSS 3.1HIGH 7.5
- TI-2026-10277 Missing authorization in eemitch Simple File List CVSS 3.1HIGH 7.5
- TI-2026-10437 Missing authorization in eemitch Simple File List CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-36847 · CVE Program
- CVE-2020-36847 · NVD
- FIRST EPSS
- GHSA-34hm-qhxq-8vfv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences