HIGH 8.6 NVD

CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing the

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

References

https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/

Published: 2026-08-19 · Source: NVD · Feed updated: 2026-08-20

This high severity vulnerability with a CVSS score of 8.6 was published on 2026-08-19 via NVD.

vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.