What is GHSA-jff9-wc66-9356?

GHSA-jff9-wc66-9356 is a security advisory published by GitHub Security Advisories with High severity. The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file...

Which CVE IDs does GHSA-jff9-wc66-9356 cover?

GHSA-jff9-wc66-9356 covers the following CVE IDs: CVE-2026-16616. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jff9-wc66-9356?

GHSA-jff9-wc66-9356 has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-jff9-wc66-9356HighCVSS 8.6

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file...

Vendor

GitHub Security Advisories

Published

August 19, 2026

Last Modified

August 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-16616 →

📋 Description

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16616
https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba
https://github.com/advisories/GHSA-jff9-wc66-9356