CVE-2026-11911

A vulnerability exists in the Simple File List plugin for WordPress, specifically in the eeSFL_DeleteFile function, which allows unauthenticated attackers to delete any file on the server due to inadequate file path validation. This flaw is present in all plugin versions up to and including 6.3.7. An attacker can exploit this vulnerability to delete files, including critical system files like wp-config.php, which can lead to remote code execution. The vulnerability can be accessed through the simplefilelist_edit_job AJAX action, which is registered to allow unauthenticated access.

Based on public CVE data (MITRE/NVD).