PT-2025-29315 · WordPress · Simple-File-List Plugin

Coiffeur · Published 2025-07-12 · Updated 2025-07-29 · CVE-2020-36847

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Simple-File-List Plugin for WordPress versions through 4.2.2

Description: The Simple-File-List Plugin for WordPress is susceptible to Remote Code Execution via the rename function. This allows unauthenticated attackers to execute code on the server by renaming uploaded PHP code with a PNG extension to use a PHP extension.

Recommendations: Update the Simple-File-List Plugin for WordPress to version 4.2.3 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-36847

Affected Products

Simple-File-List Plugin

References · 15

• 🔥 https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574 · Exploit
• 🔥 https://packetstormsecurity.com/files/160221 · Exploit
• 🔥 https://exploit-db.com/exploits/52371 · Exploit
• https://osv.dev/vulnerability/CVE-2020-36847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36847 · Security Note
• https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list · Patch
• https://t.me/cvetracker/27632 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2020042711 · Note
• https://twitter.com/cracbot/status/1945800711947907386 · Twitter Post
• https://t.me/cveNotify/130182 · Telegram Post
• https://twitter.com/VolerionSec/status/1943978537813229831 · Twitter Post
• https://twitter.com/CVEnew/status/1943977653314134198 · Twitter Post
• https://t.me/cvenotify/128692 · Telegram Post
• https://twitter.com/CveFindCom/status/1943968629160063234 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cve · Note