Security readout for executives and security teams
Plain-English summary
An unauthenticated attacker could turn an uploaded file into executable PHP on vulnerable WordPress sites using Simple File List. Successful exploitation can give server-level code execution, which may lead to site takeover, data theft, or malware hosting.
Executive priority
Prioritize remediation immediately for any internet-facing WordPress site using this plugin. The issue is unauthenticated, low-complexity remote code execution with full confidentiality, integrity, and availability impact in the CVSS assessment.
Technical view
Simple File List through 4.2.2 is reported vulnerable to unrestricted file upload handling via the rename function. An attacker can upload PHP content disguised with a PNG extension, then rename it to a PHP extension and execute code remotely without authentication.
Likely exposure
Exposure is likely limited to WordPress sites running the Simple File List plugin at version 4.2.2 or earlier. Publicly reachable sites with file upload functionality enabled have the highest concern. The bundle's affected metadata is sparse, so asset validation is important.
Exploitation context
The CVE is not marked as CISA KEV in the supplied bundle, and no cited source states active exploitation. However, the bundle includes public vulnerability and exploit references, so defenders should treat exposure as practical and time-sensitive.
Researcher notes
The key behavior is extension control through rename after upload. Focus validation on plugin versions, upload exposure, executable file placement, and historical evidence of renamed PHP files. The supplied affected CPE metadata is not detailed enough for product matching alone.
Mitigation direction
- Upgrade Simple File List to 4.2.3 or later, or the current vendor-supported release.
- Disable or remove the plugin until patched if internet-facing file upload is exposed.
- Restrict upload and rename functionality to trusted authenticated users where business use allows.
- Review vendor, Wordfence, WPScan, and WordPress plugin guidance for current remediation details.
- Inspect web roots and upload directories for unexpected PHP files.
Validation and detection
- Inventory WordPress sites for Simple File List and record installed versions.
- Confirm no site is running Simple File List version 4.2.2 or earlier.
- Review access logs for suspicious upload, rename, or PHP execution activity.
- Check upload directories for executable files with recent creation or rename timestamps.
- Validate that plugin updates were applied on production and staging systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-36847 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset/2286920/simple-file-listCVE reference
- https://packetstormsecurity.com/files/160221/CVE reference
- https://www.cybersecurity-help.cz/vdb/SB2020042711CVE reference
- https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.