CVE-2025-34085
WordPress Simple File List PHP Unrestricted File Upload RCE
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847.
INFO
Published Date :
July 9, 2025, 1:15 a.m.
Last Modified :
July 16, 2025, 4:15 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-34085
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Identify and use the correct CVE ID for remediation.
- Consult the authoritative source for CVE information.
- Update security advisories with the correct CVE data.
Public PoC/Exploit Available at Github
CVE-2025-34085 has a 7 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2025-34085
Python
None
Python
None
Python
WordPress Simple File List Unauthenticated RCE Exploit
Python
Multi-target unauthenticated RCE scanner for CVE-2025-34085 affecting WordPress Simple File List plugin. Uploads, renames, and triggers PHP webshells across large target sets.
Python
Simple File List – Unauthenticated RCE Exploit (CVE-2025-34085)
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-34085 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-34085 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Jul. 16, 2025
Action Type Old Value New Value -
CVE Modified by [email protected]
Jul. 16, 2025
Action Type Old Value New Value Changed Description An unrestricted file upload vulnerability in the WordPress Simple File List plugin prior to version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847. Removed CVSS V4.0 VulnCheck: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CWE VulnCheck: CWE-306 Removed CWE VulnCheck: CWE-434 Removed Reference VulnCheck: https://packetstorm.news/files/id/160221 Removed Reference VulnCheck: https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list Removed Reference VulnCheck: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_simple_file_list_rce.rb Removed Reference VulnCheck: https://simplefilelist.com/ Removed Reference VulnCheck: https://vulncheck.com/advisories/wordpress-simple-file-list-plugin-rce Removed Reference VulnCheck: https://web.archive.org/web/20220426044003/https://wpscan.com/vulnerability/10192/ Removed Reference VulnCheck: https://wordpress.org/plugins/simple-file-list/ Removed Reference VulnCheck: https://www.cybersecurity-help.cz/vdb/SB2020042711 Removed Reference VulnCheck: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simple-file-list/simple-file-list-423-remote-code-execution -
New CVE Received by [email protected]
Jul. 09, 2025
Action Type Old Value New Value Added Description An unrestricted file upload vulnerability in the WordPress Simple File List plugin prior to version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-306 Added CWE CWE-434 Added Reference https://packetstorm.news/files/id/160221 Added Reference https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list Added Reference https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_simple_file_list_rce.rb Added Reference https://simplefilelist.com/ Added Reference https://vulncheck.com/advisories/wordpress-simple-file-list-plugin-rce Added Reference https://web.archive.org/web/20220426044003/https://wpscan.com/vulnerability/10192/ Added Reference https://wordpress.org/plugins/simple-file-list/ Added Reference https://www.cybersecurity-help.cz/vdb/SB2020042711 Added Reference https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simple-file-list/simple-file-list-423-remote-code-execution