The vulnerability is a missing authorization flaw in the Simple File List plugin that allows unauthorized users to view files and directories that should be protected. Because the plugin does not enforce proper access control levels, an attacker can manipulate requests to bypass restrictions and retrieve sensitive files. This flaw is categorized as CWE-862, indicating an absence of required permissions and potentially exposing confidential data.

Mitchell Bennis Simple File List plugin for WordPress, version 6.1.18 and earlier, is impacted. The plugin is distributed as a WordPress plugin; all installations that have not upgraded beyond 6.1.18 are vulnerable. No specific operating system or server platform constraints are mentioned, so any environment running WordPress with this plugin could be affected.

The CVSS score of 5.4 indicates a medium severity, and the EPSS score of less than 1% shows that the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits have been reported. The attack vector is most likely through the web interface of the WordPress site; an attacker may need a valid user session or could target publicly accessible endpoints that expose the file list. Though the risk is moderate, the lack of enforced permissions could allow attackers to access confidential files.