CVE-2020-36847: falha crítica em eemitch Simple File List
Simple File List < 4.2.3 - Remote Code Execution
Publicada em · Atualizada em
97Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.8epss 45%
da publicação à arma10 dias
Publicada no NVD12 de jul.
1ª PoC+10d
metasploit27 de abr.
VulnCheck+346d
probabilidade de exploração
45%top 1% das CVEs
exploração observada
simVulnCheck
5 exploit(s) público(s)
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
eemitch · Simple File ListPoCs públicas encontradas — 5
exploitdbwww.exploit-db.com/exploits/52371não verificadogithubgithub.com/ftz7/PoC-CVE-2020-36847-WordPress-Plugin-4.2.2-RCE★ 1cve_referencepacketstormsecurity.com/files/160221/não verificadovulncheckvulncheck.com/xdb/ec52bbb216f8não verificadovulncheckvulncheck.com/xdb/ee72a50e36eenão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — eemitch Simple File List
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1119HIGHSimple File List <= 3.2.7 - Arbitrary File DownloadEPSS 20.0%CVE-2026-11911HIGHSimple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' ParameterEPSS 1.2%CVE-2026-11912HIGHSimple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX ActionEPSS 0.5%CVE-2026-12119MEDIUMSimple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode AttributeEPSS 0.5%
Referências
https://packetstormsecurity.com/files/160221/https://plugins.trac.wordpress.org/changeset/2286920/simple-file-listhttps://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/https://www.cybersecurity-help.cz/vdb/SB2020042711https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cve