What’s Vulnerable › Vulnerabilities

CVE-2023-4297: Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-27 · updated 2026-06-17

Description

The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.

Affected products

• Mmm Simple File List: through 2.3

References

• https://wpscan.com/vulnerability/9ff85b06-819c-459e-90a9-6151bfd70978
• https://wpscan.com/vulnerability/9ff85b06-819c-459e-90a9-6151bfd70978

Get alerted when CVE-2023-4297 or the next vulnerability affects your stack