CVE-2026-16616CWE-22path-traversal
CVE-2026-16616
High · published August 19, 2026
What it is
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
The record
Technical detail
- CVSS v3.1
- 8.6 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00732 · 53.8th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2026-08-19T10:17Z
References (1)
EPSS history
Timeline