CVE-2026-11911 is a path traversal vulnerability (CWE-22) in the Simple File List plugin for WordPress, affecting all versions up to and including 6.3.7. The vulnerability arises from inadequate file path validation in the eeSFL_DeleteFile function, enabling unauthenticated attackers to delete arbitrary files on the server. The attack vector is the simplefilelist_edit_job AJAX action registered via wp_ajax_nopriv_, making it accessible without authentication. The is_admin() guard intended to restrict access is ineffective because it always returns true for requests to admin-ajax.php, allowing bypass. Successful exploitation can lead to deletion of critical files like wp-config.php, potentially resulting in remote code execution.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin. This can disrupt website functionality and potentially lead to remote code execution if critical files such as wp-config.php are deleted. The vulnerability has a CVSS 3.1 base score of 7.5 (High), reflecting its network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to admin-ajax.php where possible and monitor for suspicious requests targeting the simplefilelist_edit_job action. Avoid using the affected plugin versions (<=6.3.7) in production environments. Follow vendor updates closely for an official patch or temporary mitigation.