CVE-2026-12119 is a missing authorization vulnerability (CWE-862) in the Simple File List plugin for WordPress, affecting all versions up to 6.3.7. The flaw lies in the 'frontmanage' shortcode attribute, which lacks proper authorization checks. An attacker with contributor-level privileges can craft a draft post containing the 'eeSFL' shortcode, use the post preview endpoint to extract a nonce required for authorization, and then execute arbitrary file operations including deletion, moving, folder creation, and downloading by sending specially crafted requests to includes/ee-list-ops-bar-process.php. This bypasses the intended access controls, leading to unauthorized file manipulation.

The vulnerability allows authenticated users with contributor-level access or higher to perform unauthorized file operations on the server hosting the WordPress site. This includes deleting, moving, creating folders, and downloading files, which can lead to data loss or unauthorized data disclosure. The CVSS score of 6.5 reflects a medium severity with high impact on integrity but no impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access where possible and monitor for suspicious activity related to file operations. Avoid publishing draft posts containing the 'eeSFL' shortcode and limit the use of the post preview endpoint by contributors. Follow vendor updates closely for an official patch or temporary mitigation.