WordPress Plugin Vulnerabilities

Simple File List <= 6.1.16 - Missing Authorization

Description

The Simple File List plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.1.16. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
simple-file-list
No known fix

References

CVE
CVE-2025-68591
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8939cad2-f9fc-45aa-97d1-9a1a2a59bf94

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
25b593ff-9e7e-43e8-b630-9fdd6f3548eb

Timeline

Publicly Published
2025-12-25 (about 4 months ago)
Added
2026-01-05 (about 4 months ago)
Last Updated
2026-01-05 (about 4 months ago)

Other

Published
Title
Published
2023-11-03
Title
Simple Job Board < 2.10.6 - Missing Authorization
Published
2024-04-26
Title
Save as PDF plugin by Pdfcrowd < 3.2.1 - Missing Authorization
Published
2025-06-26
Title
VG WORT METIS <= 2.0.1 - Missing Authorization
Published
2025-02-17
Title
Affiliate Links: WordPress Plugin for Link Cloaking and Link Management < 3.1.0 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection
Published
2026-04-16
Title
WP Statistics < 14.16.5 - Subscriber+ Sensitive Information Exposure and Privacy Audit Manipulation