« Volver al listado

CVE-2020-36847

Estado: AnalizadaCrítica (9.8)—

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Plugin WordPress expuesto sin autenticación (AV:N, PR:N, UI:N) permite renombrar archivos PHP con extensión .png a .php, logrando web shell. CVSS crítico confirma RCE remota sin privilegios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningUser Account ManagementRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (1)

Simplefilelist — Simple File List

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-36847",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2020-36847",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-14T14:39:22.829799Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "eemitch",
          "product": "Simple File List",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.2.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-12T10:15:24.770",
  "references": [
    {
      "url": "https://packetstormsecurity.com/files/160221/",
      "tags": [
        "Exploit"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list",
      "tags": [
        "Patch"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.cybersecurity-help.cz/vdb/SB2020042711",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server."
    },
    {
      "lang": "es",
      "value": "El complemento Simple-File-List para WordPress es vulnerable a la ejecución remota de código en versiones hasta la 4.2.2 incluida, a través de la función de cambio de nombre, que permite renombrar código PHP subido con extensión PNG para usar una extensión PHP. Esto permite a atacantes no autenticados ejecutar código en el servidor."
    }
  ],
  "lastModified": "2026-06-17T03:16:19.233",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AA3F2B1-0A2D-4538-AE6E-DA7F2BE8C82E",
              "versionEndExcluding": "4.2.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@wordfence.com"
}