CVE-2026-16616— Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
Quick assessment
Affected
Unknown Simple File List
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Simple File List WordPress 插件在版本 6.3.11 及以下版本中，未对文件移动操作所涉及的源路径进行验证，该漏洞可被未认证用户利用。攻击者借此可读取服务器上的任意文件，并将关键文件从网站根目录移出，从而导致敏感信息泄露，甚至可能引发站点被接管。
Possible ATT&CK Techniques 3 AI
T1105 · Ingress Tool Transfer T1005 · Data from Local System T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Simple File List | ≤ 6.3.11 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16616
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Simple File List | 0 ~ 6.3.11 | - |
|
II. Public POCs for CVE-2026-16616
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16616
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16616 (1)
-
🔗 Simple File List <= 6.3.11 – Unauthenticated Arbitrary File Read and Move via Path Traversal | CVE 2026-16616 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-19 · 38 CVEs total
| CVE-2026-18779 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record De | |
| CVE-2026-17565 | Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery | |
| CVE-2026-18466 | WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation | |
| CVE-2026-18051 | W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Ove | |
| CVE-2026-18231 | WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user | |
| CVE-2026-18202 | JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-18776 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJA | |
| CVE-2026-18778 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multi | |
| CVE-2026-18777 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Chan | |
| CVE-2026-18937 | Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection | |
| CVE-2026-18031 | TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback | |
| CVE-2026-19055 | ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters | |
| CVE-2026-19709 | Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consu | |
| CVE-2026-19056 | ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter | |
| CVE-2026-19416 | KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR | |
| CVE-2026-19406 | Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appoint | |
| CVE-2026-19417 | KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR | |
| CVE-2026-19782 | WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users | |
| CVE-2026-19842 | SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SA | |
| CVE-2026-14334 | Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SV |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Simple File List
-
CVE-2026-16617
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via -
CVE-2026-57382
WordPress Simple File List plugin <= 6.3.8 - Reflected Cross -
CVE-2026-12119
Simple File List <= 6.3.7 - Missing Authorization to Authent -
CVE-2026-11911
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File D -
CVE-2026-11912
Simple File List <= 6.3.7 - Missing Authorization to Unauthe
Same vendor: Unknown
-
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr -
CVE-2026-13598
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation
V. Comments for CVE-2026-16616
No comments yet