Description
WordPress Plugin Simple File List is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin Simple File List version 4.2.7 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 4.2.8 or latest
References
https://ctulhu.me/2020/05/16/cve-2020-12832/
https://plugins.svn.wordpress.org/simple-file-list/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin PowerPress Podcasting by Blubrry Cross-Site Scripting (6.0.4)
WordPress Plugin Animate It! Cross-Site Scripting (2.3.4)
WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Cross-Site Scripting (1.5.75)
WordPress Plugin Interactive Geo Maps Cross-Site Scripting (1.5.8)