{"id":59460,"date":"2025-07-18T04:46:06","date_gmt":"2025-07-18T04:46:06","guid":{"rendered":""},"modified":"2025-08-29T22:44:09","modified_gmt":"2025-08-30T04:44:09","slug":"cve-2020-36847-remote-code-execution-vulnerability-in-simple-file-list-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2020-36847-remote-code-execution-vulnerability-in-simple-file-list-wordpress-plugin\/","title":{"rendered":"CVE-2020-36847: Remote Code Execution Vulnerability in Simple-File-List WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Simple-File-List Plugin for WordPress, popular for file management among the WordPress community, has been found to contain a critical remote code execution vulnerability. Identified as CVE-2020-36847, this vulnerability poses a significant risk to any WordPress site using versions up to, and including, 4.2.2 of the plugin. Unauthenticated attackers can exploit this vulnerability to execute arbitrary code<\/a> on the server, potentially compromising the system and leading to data leakage.
\nThis vulnerability is of particular concern due to the high severity<\/a> score of 9.8 assigned by CVSS, which reflects its potential impact on system integrity and confidentiality. The fact that this vulnerability can be exploited without the attacker<\/a> requiring any prior authentication makes it all the more dangerous.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2020-36847
\nSeverity: Critical (CVSS: 9.8)
\nAttack Vector: Remote
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise and potential data<\/a> leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Simple-File-List Plugin for WordPress<\/a> | Up to and including 4.2.2<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the ‘rename’ function of the Simple-File-List plugin<\/a>. An unauthenticated attacker can exploit this function to rename a previously uploaded PHP file<\/a> disguised with a .png extension to a .php extension. Once the malicious PHP file<\/a> is successfully renamed, it can be executed on the server, leading to remote code execution.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP POST request that an attacker might use to rename a malicious file:<\/p>\n

POST \/wp-content\/plugins\/simple-file-list\/ee-upload-engine.php HTTP\/1.1\nHost: vulnerable-site.com\nfileOldName=malicious.png&fileNewName=malicious.php<\/code><\/pre>\n
In this request, `fileOldName` parameter is the name of the already uploaded malicious file<\/a> disguised as a .png file and `fileNewName` is the new name with a .php extension. After this request, the server will rename the file, and the PHP code can be executed remotely<\/a>.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
To mitigate this vulnerability, it is strongly advised to apply the vendor’s patch. If for some reason the patch cannot be applied promptly, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. These systems can be configured to block or alert on HTTP requests that attempt to rename files with a .php<\/a> extension.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Simple-File-List Plugin for WordPress, popular for file management among the WordPress community, has been found to contain a critical remote code execution vulnerability. Identified as CVE-2020-36847, this vulnerability poses a significant risk to any WordPress site using versions up to, and including, 4.2.2 of the plugin. Unauthenticated attackers can exploit this vulnerability to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59460","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t