What is CVE-2026-16616?

CVE-2026-16616 is a high-severity vulnerability in Simple File List, classified under Path Traversal. CVSS score: 8.6/10. Published 2026-08-19.

How severe is CVE-2026-16616?

High severity. CVSS v3 base score is 8.6 out of 10.

Path Traversal in Simple File List

CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Unknown Simple File List

Weakness classification (CWE)

CWE-22 — Path Traversal

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-16616?: CVE-2026-16616 is a high-severity vulnerability in Simple File List, classified under Path Traversal. CVSS score: 8.6/10. Published 2026-08-19.
How severe is CVE-2026-16616?: High severity. CVSS v3 base score is 8.6 out of 10.