Critical severity · published Jul 12, 2025
CVE-2020-36847
Simple File List < 4.2.3 - Remote Code Execution
9.8
CVSS
43.5%
EPSS
No
On KEV
Description
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)43.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Simple File List · eemitch
before 4.2.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36847
Exploit
https://packetstormsecurity.com/files/160221/
Patch
https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list
Exploit
https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/
Third Party Advisory
https://www.cybersecurity-help.cz/vdb/SB2020042711
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cve
More from Simple File List
7.5
CVE-2026-11911
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
7.5
CVE-2026-11912
Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
6.5
CVE-2026-12119
Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute