WordPress Plugin Vulnerabilities

Simple File List < 6.1.15 - Unauthenticated Arbitrary File Download

Description

The Simple File List plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.14. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affects Plugins

Plugin icon
simple-file-list
Fixed in 6.1.15

References

CVE
CVE-2025-54021
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbb6a4c-120f-43d1-8ec9-dac52186d81a

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Phat RiO - BlueRock
Verified
No
WPVDB ID
45956bfe-5c31-4e6b-b9a8-bd300cb82569

Timeline

Publicly Published
2025-07-28 (about 9 months ago)
Added
2025-08-04 (about 9 months ago)
Last Updated
2025-08-04 (about 9 months ago)

Other

Published
Title
Published
2025-10-10
Title
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion
Published
2025-07-23
Title
Latepoint < 5.1.94 - Unauthenticated LFI
Published
2025-06-13
Title
Restrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read
Published
2025-12-09
Title
Simple Download Counter < 2.2.3 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal
Published
2024-08-09
Title
Web Directory Free < 1.7.3 - Unauthenticated LFI