CVE-2026-16616 Simple File List CVE debrief

Who should care

Administrators of WordPress sites using the Simple File List plugin, as well as security teams responsible for monitoring and mitigating vulnerabilities in WordPress plugins, should be aware of this vulnerability and take immediate action to address it. The vulnerability allows unauthenticated users to read arbitrary files and relocate critical files, leading to sensitive information disclosure and potential site takeover. Security teams should review server logs for suspicious file access and relocation attempts and consider implementing additional security controls.

Technical summary

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation, allowing unauthenticated users to read arbitrary files on the server and relocate critical files out of the web root. This vulnerability leads to sensitive information disclosure and potential site takeover. The vulnerability is caused by a lack of input validation and sanitization in the file-move operation. The affected product is the Simple File List WordPress plugin, and the vulnerability affects versions prior to 6.3.12.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows unauthenticated users to read arbitrary files and relocate critical files.

Recommended defensive actions

• Review and update the Simple File List WordPress plugin to version 6.3.12 or later
• Restrict access to file-move operations to authenticated users
• Monitor server logs for suspicious file access and relocation attempts
• Consider implementing additional security controls, such as file access controls and monitoring
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the NVD and WPScan indicates that the Simple File List WordPress plugin is vulnerable to arbitrary file reading and relocation. The vulnerability allows unauthenticated users to read arbitrary files on the server and relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover. Further details are limited, and defenders should verify the affected scope and severity with the vendor. Limited evidence suggests that the vulnerability is being actively exploited in the wild, but no specific details are available. Defenders should review server logs for suspicious file access and relocation attempts and consider implementing additional security controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.