# CVE-2020-36847: Simple File List < 4.2.3 - Remote Code Execution

- Exploited (CISA KEV): no
- Published: 2025-07-12
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 43.5% (99th percentile)
- CWE: CWE-434

The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-12-03 | 144 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2025-12-03 · new · rule 200020231
  > Added: signature 200020231 "WordPress Simple File List Plugin Insecure File Upload" (Malicious File Upload, risk High), systems: WordPress. References: CVE-2025-34085, CVE-2020-36847.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2020-36847 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2020-36847