Simple File List: Unauthenticated arbitrary file deletion via path traversal
Summary
The Simple File List WordPress plugin up to and including version 6.3.11 contains a path traversal flaw (CWE-22) that allows arbitrary file deletion. An unauthenticated attacker can send a crafted request without user interaction and delete files on the web server, which can break the website. Deleting a critical file such as wp-config.php can enable a full takeover; Wordfence rates the issue 9.1 (Critical), while the CVE record gives 8.6 (High).
Affected
- WordPress plugin Simple File List, all versions up to and including 6.3.11
- Default installations are unaffected only if the plugin is not installed
Fixed in
Unknown. No official patch or fixed version has been found. An unofficial fork (v6.3.12) exists but is unverified and does not name this CVE.
Workaround
- Deactivate and remove the plugin if the file-list function is not needed.
- Ask your WAF or virtual-patching provider whether a mitigation rule covers CVE-2026-39792.
- Restrict access to the plugin's front-end endpoints where possible.
Exploitation
- No known exploitation reported; not listed as known exploited (KEV: No).
- No public proof of concept found.
- CISA SSVC: automatable yes, technical impact partial.
- Patchstack expects exploitation and reports mass-exploit potential.
Our recommendation
- Check whether any site (including sites managed by agencies or hosting providers) runs Simple File List 6.3.11 or earlier.
- If the plugin is not needed, remove it.
- If it must stay, apply virtual patching if available and create verified offline backups of the site and database before any change.
- Check the integrity of wp-config.php and the plugin directories, and monitor for unexpected file deletions.
- Watch the vendor and Wordfence for an official fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: Arbitrary File Deletion in WordPress Simple File List Plugin patchstack.com
- WPScan: Simple File List vulnerability (CVE-2026-39792) wpscan.com
- HOL Guard: CVE-2026-39792 hol.org
- Strix: CVE-2026-39792 www.strix.ai
- WPScan: Simple File List plugin page wpscan.com
- WPScan: Earlier file deletion vulnerability (CVE-2023-44227) wpscan.com
- Patchstack: Simple File List plugin index patchstack.com
- WordPress.org: Simple File List plugin en-gb.wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:21.
Original description (NVD)
Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.