Critical severity9.8NVD Advisory· Published Jul 12, 2025· Updated Jun 17, 2026
CVE-2020-36847
CVE-2020-36847
Description
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*Range: <4.2.3
<=4.2.2+ 1 more
- (no CPE)range: <=4.2.2
- (no CPE)
- Range: 0
Patches
Vulnerability mechanics
References
5- plugins.trac.wordpress.org/changeset/2286920/simple-file-listnvdPatch
- packetstormsecurity.com/files/160221/nvdExploit
- wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/nvdExploitThird Party Advisory
- www.cybersecurity-help.cz/vdb/SB2020042711nvdThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07envdThird Party Advisory
News mentions
2- Australia warns of global campaign targeting vulnerable CMS platformsBleepingComputer · Jul 11, 2026
- Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress SitesThe Hacker News · Jul 10, 2026