Unrated severityNVD Advisory· Published Aug 19, 2026

CVE-2026-16616

Description

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Simple File Listllm-fuzzy
Range: <=6.3.11
Package: https://wordpress.org/plugins/simple-file-list

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000