CVE-2020-36847

This exploit targets a file upload vulnerability in the Simple File List WordPress plugin (CVE-2020-36847), allowing arbitrary file upload and renaming to achieve remote code execution (RCE). It uploads a PHP payload disguised as an image, renames it to a .php file, and verifies execution.

This repository contains a functional exploit for CVE-2020-36847, an arbitrary file upload vulnerability in the WordPress Simple File List plugin (version 4.2.2). The exploit uploads a malicious PHP file disguised as a PNG, renames it to execute PHP code, and confirms RCE by accessing the uploaded shell.

The repository contains a markdown file describing CVE-2020-36847, a Remote Code Execution vulnerability in the Simple File List WordPress plugin (versions ≤4.2.2). The file outlines the vulnerability's impact but lacks exploit code or technical details for exploitation.

This repository contains a functional exploit for CVE-2025-34085 (duplicate of CVE-2020-36847), targeting WordPress Simple File List plugin versions ≤ 4.2.2. The exploit uploads a malicious PHP file disguised as a PNG, renames it to a PHP extension, and executes arbitrary commands.

This repository contains a functional exploit for CVE-2020-36847, targeting the WordPress Simple File List plugin (version 4.2.2). The exploit demonstrates arbitrary file upload leading to remote code execution (RCE) by uploading a malicious PHP file disguised as an image and renaming it to execute on the server.

This Metasploit module exploits an unauthenticated file upload vulnerability in the WordPress Simple File List plugin (CVE-2020-36847). It uploads a malicious PHP payload disguised as a PNG file, renames it to a PHP file, and executes it to achieve remote code execution.