CVE-2020-36847

Simple File List is a WordPress add-on that lets a site show files. In this bug, an attacker can disguise a harmful code file as something harmless, trick the plugin into renaming it, and then run that code on your server. It’s like giving an intruder a way to slip a “harmless-looking package” past your front desk—and once inside, they can take over the building.

This matters if you run WordPress and have the “Simple File List” plugin installed and active, specifically an affected version up to 4.2.2. The key risk is that attackers do not need a login and there is no user action required. The danger is real when the plugin is installed and reachable on your website (the plugin must be active in a vulnerable version, up to 4.2.2).

This is RED because there is confirmed real-world exploitation in active campaigns, including reports of attackers deploying webshells via this type of vulnerability. Attackers can use it without logging in, which means a public-facing WordPress site with an affected plugin version is directly at risk. Patch-level action is required now because attackers can move quickly once they find exposed sites.

1. Confirm exposure (quick check)

   • In WordPress, go to Plugins and locate “Simple File List.”
   • Record the installed version.
   • Exposure condition from the findings: plugin must be installed and active in a vulnerable version (up to 4.2.2).

2. Apply the fix

   • Upgrade Simple File List to version 4.2.3.
   • After upgrade, confirm the plugin version now shows 4.2.3.

3. If you cannot upgrade immediately (temporary containment)

   • Disable the Simple File List plugin in WordPress.
   • If the business can tolerate it, remove the plugin until an upgrade to 4.2.3 is completed.

4. Look for attacker persistence (post-fix verification)

   • Scan for unexpected PHP files in web-accessible areas (especially locations associated with uploads or where the plugin writes/renames files).
   • Review server/web logs around the time of exposure for suspicious upload/rename requests.
   • If you discover unexpected webshells, remove them and rotate any exposed credentials (admin passwords, FTP/SFTP, database passwords) because a full compromise is possible.

5. What to monitor going forward

   • New unexpected file uploads.
   • Rename/move operations involving uploaded files.
   • Repeated 4xx/5xx spikes around file upload endpoints.

6. Timelines

   • No CISA KEV listing was provided for this CVE in the findings, but real-world exploitation was reported, so follow the “upgrade immediately” mindset rather than waiting for a later schedule.

Fixed version(s) from the findings:

• Simple File List → 4.2.3

CVE-2020-36847 is a critical Remote Code Execution (CWE-434) affecting the Simple File List WordPress plugin in versions up to 4.2.2. The mechanism is an abuse of a rename function after uploading a malicious PHP payload disguised with a .png (image) appearance; the file is then made to execute as PHP on the server. Authentication is not required (no login needed) and no user interaction is required according to the findings.

Exploitation status: The findings report that exploitation is occurring in the wild (webshell deployment reported in a global CMS-targeting campaign). Public exploit(s) are available (2 known), indicating weaponization.

Fix: Simple File List is fixed in 4.2.3. KEV was not listed in CISA KEV in the provided findings.

Operational implication: If your site has the vulnerable plugin version installed and active, an internet-based attacker can directly attempt code execution against the server via the plugin’s upload/rename behavior, making this a high-priority patch situation.