CVE-2020-36847

Simple File List is a WordPress add-on that lets a site show files. In this bug, an attacker can disguise a harmful code file as something harmless, trick the plugin into renaming it, and then run that code on your server. It’s like giving an intruder a way to slip a “harmless-looking package” past your front desk—and once inside, they can take over the building.

This matters if you run WordPress and have the “Simple File List” plugin installed and active, specifically an affected version up to 4.2.2. The key risk is that attackers do not need a login and there is no user action required. The danger is real when the plugin is installed and reachable on your website (the plugin must be active in a vulnerable version, up to 4.2.2).

This is RED because there is confirmed real-world exploitation in active campaigns, including reports of attackers deploying webshells via this type of vulnerability. Attackers can use it without logging in, which means a public-facing WordPress site with an affected plugin version is directly at risk. Patch-level action is required now because attackers can move quickly once they find exposed sites.