CVE-2022-1119

HIGH IN THE WILD NUCLEI

Simple File List <= 3.2.7 - Unauthenticated Arbitrary File Download via eeFile Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-1119 has been observed exploited in the wild (reported by InTheWild.io). EIP tracks 1 public exploit from researchers including z92g. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a Go-based scanner for CVE-2022-1119, a file read vulnerability in WordPress Simple File List plugin versions < 3.2.8. It checks for the presence of the vulnerability by attempting to read the wp-config.php file via a path traversal payload.

Description

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.

Exploits (1)

nomisec SCANNER 5 stars
by z92g · poc
https://github.com/z92g/CVE-2022-1119

This repository contains a Go-based scanner for CVE-2022-1119, a file read vulnerability in WordPress Simple File List plugin versions < 3.2.8. It checks for the presence of the vulnerability by attempting to read the wp-config.php file via a path traversal payload.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: WordPress Simple File List < 3.2.8
No auth needed
Prerequisites: Target must have the vulnerable WordPress Simple File List plugin installed and accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

WordPress Simple File List <3.2.8 - Local File Inclusion
HIGHby random-robbie

Scores

CVSS v3 7.5
EPSS 0.1961
EPSS Percentile 97.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

InTheWild.io 2022-11-16
CWE
CWE-22
Status published
Products (2)
eemitch/Simple File List < 3.2.7
simplefilelist/simple-file-list < 3.2.8
Published Apr 19, 2022
Tracked Since Feb 18, 2026