Every CVESearch/Get API key

CVE-2020-36847

Simple File List < 4.2.3 - Remote Code Execution

9.8 CriticalPublic exploit

CVE-2020-36847 is a critical vulnerability (CVSS 9.8) in Eemitch Simple File List, published July 12, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 59.0%, the 99th percentile. No source names a fixed version.

What does this mean?
Severity
9.8 CriticalCVSS 3.1, CVE List
Exploit chance
59.0%EPSS, 99th percentile
Exploitation
None known3 public exploits
Fixed in
No fix listedNo source names one

Description

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

59.0%Up 58.9 points since Jul 12, 2025
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitWordPress Simple File List Unauthenticated Remote Code Execution2020-04-27
Exploit-DBSimple File List WordPress Plugin 4.2.2 - File Upload to RCE2025-07-22
NucleiWordPress Simple File List < 4.2.3 - Unauthenticated Remote Code Execution

What each source reports

CVE List Score used9.8

Simple File List < 4.2.3 - Remote Code Execution

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

Record
CVE-2020-36847
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
EUVDEUVD-2020-307979.8

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

Record
EUVD-2020-30797
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-34hm-qhxq-8vfv9.8

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up...

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

Record
GHSA-34hm-qhxq-8vfv
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
NVD9.8

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

Record
CVE-2020-36847
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02

History

History
RecordedChangedSources
exploitsNuclei
exploits, facts
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open