The Simple File List plugin for WordPress contains a path traversal (CWE-22) flaw that allows an attacker to request files outside the intended plugin directory. Because the plugin does not validate or restrict requested paths, an adversary can craft HTTP requests to download any file that the WordPress process can read on the server. The vulnerability can therefore be used to exfiltrate sensitive configuration files or personal data, leading to confidentiality loss.

WordPress sites that have the Simple File List plugin installed with a version of 6.1.14 or earlier are vulnerable. The flaw spans all releases from the initial release through 6.1.14, affecting any WordPress installation that has enabled the plugin and has the download endpoint exposed.

The CVSS score of 7.5 represents high severity. EPSS is reported as less than 1%, indicating that exploitation attempts are currently rare and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker needs only to construct a malicious URL targeting the plugin’s download functionality, and if successful, will gain read access to arbitrary files on the hosting machine.