The Simple File List plugin for WordPress contains a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to 6.3.7. As a result, any authenticated user who possesses at least Contributor permissions can invoke file operations such as deletion, moving, folder creation, and download without proper privilege validation. The vulnerability allows the attacker to manipulate the site's file repository, potentially leading to data loss, site corruption, or the introduction of malicious content, thereby compromising the integrity and availability of the site.

WordPress installations using the eemitch Simple File List plugin version 6.3.7 or earlier are affected. Sites that permit contributors to create or preview posts are directly impacted, as the exploitation workflow requires these capabilities to obtain the required nonce and trigger the unsupported file operations.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, suggesting limited publicly observed exploitation. The flaw can be exploited by any authenticated user with Contributor or higher privileges by using the post preview endpoint to harvest the needed nonce and then submitting file operation requests that bypass the missing checks. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale exploitation is currently documented.