CVE-2023-4297

Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing

The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.

Affected

Mmm Simple File List

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.64% chance of exploitation in the next 30 days, 50th percentile

Published

2023-11-27

Updated

2025-06-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9ff85b06-819c-459e-90a9-6151bfd70978

References

• CVE Record
• NVD entry