CVE-2020-36847 Information

Jul 13, 2025 cve

Description

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://packetstormsecurity.com/files/160221/ https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/ https://www.cybersecurity-help.cz/vdb/SB2020042711 https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cve

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8

CNNVD-202507-1728 (Published: 2025-07-12)

Share on: