Loading vulnerability…
CVE-2020-36847 is a remote code execution vulnerability in the Simple File List plugin for WordPress affecting versions up to and including 4.2.2. The flaw is caused by insecure handling in the plugin's rename functionality, which allows an attacker to rename an uploaded file from a non-executable extension such as an image extension to a PHP extension. In practice, this enables an unauthenticated attacker to upload PHP code disguised as a benign file and then convert it into an executable server-side script through the rename feature. If the web server executes PHP in the affected upload location, the attacker can run arbitrary code on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a Python proof-of-concept exploit targeting a WordPress plugin vulnerability in Simple File List that enables arbitrary file upload leading to RCE. Structure: (1) README.md explains the attack chain (upload disguised as .png, rename to .php, then access in uploads) and usage with a target list; (2) exploit.py is the main script; (3) list.txt is a sample input list; (4) shells_found.txt is an output log. Exploit flow in exploit.py: it normalizes each target URL (adds scheme and trailing slash), then for each target uses requests to POST a multipart upload to /wp-content/plugins/simple-file-list/ee-upload-engine.php with filename pwn.png but content set to a PHP payload. It then POSTs to /wp-content/plugins/simple-file-list/ee-file-engine.php with parameters oldFile/newFile to rename the uploaded file to .php. Finally it constructs the expected public URL under /wp-content/uploads/simple-file-list/<newfile> and performs an HTTP GET to confirm a 200 response; successful URLs are appended to shells_found.txt. The script is multi-target and parallelized using ThreadPoolExecutor with 100 workers, and disables TLS verification (verify=False), making it suitable for scanning/exploitation across many hosts.
Repository contains a Python3 exploit (exploit.py) and a README describing CVE-2025-34085 (rejected duplicate of CVE-2020-36847) affecting the WordPress Simple File List plugin <= 4.2.2. The exploit performs unauthenticated RCE by (1) POSTing a multipart upload to /wp-content/plugins/simple-file-list/ee-upload-engine.php with a PHP payload masquerading as an image (filename random .png), then (2) POSTing to /wp-content/plugins/simple-file-list/ee-file-engine.php to rename the uploaded file to a PHP extension (tries php, phtml, php5, php3), and (3) GET requesting the resulting URL under /wp-content/uploads/simple-file-list/ to execute commands. It supports single-target mode (-u/--url) and mass scanning via targets.txt using a ThreadPoolExecutor (20 threads). Payload behavior is configurable: default drops a persistent webshell using system($_GET['cmd']) and executes the provided --cmd via ?cmd=; --inline embeds the command directly in the PHP file and triggers it with a plain GET (useful for reverse shells or query-string filtering). Successful exploitation is logged to vuln.txt with the shell URL and command output. The script disables TLS verification (verify=False) and uses basic headers (User-Agent/Accept) plus Referer/Origin for the upload request.
This repository contains a single Metasploit module targeting the WordPress Simple File List plugin (versions prior to 4.2.3) for unauthenticated remote code execution (CVE-2020-36847). The exploit works by uploading a PHP payload disguised as a PNG file via the plugin's upload endpoint, then renaming it to a .php file using a vulnerable rename function that does not enforce extension restrictions. The payload is then executed by accessing it via HTTP. The module is fully integrated with Metasploit, allowing for customizable payloads (defaulting to php/meterpreter/reverse_tcp) and automated cleanup. The code is written in Ruby and leverages Metasploit's HTTP and WordPress helper modules. The main endpoints targeted are the plugin's upload and file management PHP scripts. The exploit is weaponized and suitable for use in real-world attack scenarios where the vulnerable plugin is present.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Eemitch Simple File List vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
Vulnerability in the Simple File List WordPress plugin listed by the alert as being exploited in a large-scale CMS exploitation campaign.
A publicly known and patched vulnerability affecting the Simple File List WordPress plugin that is being exploited in a large-scale CMS campaign to deploy webshells.
A vulnerability in the Simple File List WordPress plugin listed by ACSC as exploited in a global CMS webshell deployment campaign.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.