The Simple File List plugin allows unauthenticated users to delete and modify arbitrary files on the server because all versions up to 6.3.7 lack proper authorization checks. The vulnerability stems from a missing access control (CWE‑862) and is exploitable even when the administrator has disabled the AllowFrontManage option, as the is_admin() guard is bypassed before that setting is evaluated. A successful exploitation results in compromised site integrity and potential full take‑over of the underlying WordPress installation.

Any WordPress site that has installed the Simple File List plugin by eemitch, specifically versions 6.3.7 or earlier, is affected. Sites using this plugin in any environment, whether production, staging, or testing, are at risk.

The CVSS score of 7.5 classifies the issue as high severity, indicating substantial impact on confidentiality, integrity, and availability if exploited. EPSS information is currently unavailable, so the precise likelihood of exploitation cannot be quantified, but the absence of action by the plugin vendor and the straightforward attack path suggest a reasonable probability of use. The vulnerability is not listed in the CISA KEV catalog, yet the attack vector—unauthenticated AJAX requests—remains readily exploitable with minimal prerequisites.