PT-2025-28831 · WordPress · Wordpress Simple File List

Coiffeur · Published 2025-07-09 · Updated 2025-11-14 · CVE-2025-34085

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: Simple File List plugin for WordPress versions prior to 4.2.3

Description: An unrestricted file upload vulnerability exists in the Simple File List plugin for WordPress. The plugin’s upload endpoint (ee-upload-engine.php) restricts file uploads based on extension but lacks proper validation after renaming. An attacker can upload a PHP payload disguised as a .png file and then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php, bypassing upload restrictions and enabling execution of the uploaded payload on the server.

Recommendations: Update the Simple File List plugin to version 4.2.3 or later.

Exploit

Fix

RCE

Missing Authentication

Unrestricted File Upload

Weakness Enumeration

CWE-306

CWE-434

Related Identifiers

CVE-2025-34085

Affected Products

Wordpress Simple File List

References · 23

• 🔥 https://github.com/ill-deed/CVE-2025-34085-Multi-target · Exploit
• 🔥 https://packetstorm.news/files/id/160221 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_simple_file_list_rce.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34085 · Security Note
• https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list · Patch
• https://twitter.com/illdeed/status/1944235621830037974 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1942834321234047265 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1lzihof/top_10_trending_cves_14072025 · Reddit Post
• https://twitter.com/wtf_brut/status/1944311717829530087 · Twitter Post
• https://vulncheck.com/advisories/wordpress-simple-file-list-plugin-rce · Note
• https://twitter.com/HackingTeam777/status/1944310975546396704 · Twitter Post
• https://wordpress.org/plugins/simple-file-list · Note
• https://t.me/brutsecurity/2377 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simple-file-list/simple-file-list-423-remote-code-execution · Note
• https://twitter.com/HackGitToolkit/status/1944943383186931926 · Twitter Post