Mitchell Bennis Simple File List Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the Mitchell Bennis Simple File List WordPress plugin, affecting versions through 6.1.14. This vulnerability allows unauthorized users to download arbitrary files from the server, potentially including sensitive information such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, including credentials and backup data.

Remediation

Users of the Simple File List WordPress plugin should update to version 6.1.15 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.