CVE-2026-11911 is a path traversal vulnerability (CWE-22) in the Simple File List WordPress plugin by eemitch. The vulnerability arises from inadequate file path validation in the eeSFL_DeleteFile function in all versions up to and including 6.3.7. The simplefilelist_edit_job AJAX action is registered with wp_ajax_nopriv_, allowing unauthenticated access. The typical is_admin() guard is ineffective because it returns true for requests to admin-ajax.php, enabling attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are deleted.

An unauthenticated attacker can delete arbitrary files on the server hosting the WordPress site using the vulnerable Simple File List plugin. This can disrupt site functionality and potentially allow remote code execution if key files are removed. The vulnerability has a CVSS score of 7.5, indicating high severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Confidentiality impact is high due to potential exposure from deleted files, while integrity and availability impacts are not explicitly stated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the admin-ajax.php endpoint or disable the Simple File List plugin if possible. Monitor for updates from the vendor eemitch and apply official patches once released. Avoid relying on the is_admin() check as it does not prevent unauthenticated access to the vulnerable AJAX action.