CVE-2023-44227: 
WordPress vulnerability analysis and mitigation

The Simple File List WordPress plugin contains a Missing Authorization vulnerability (CVE-2023-44227) affecting versions up to and including 6.1.9. The vulnerability was discovered by Rafshanzani Suhada and publicly disclosed on September 28, 2023. The issue was fixed in version 6.1.10 (WPScan, Patchstack).

The vulnerability is classified as a Broken Access Control issue (OWASP Top 10 A5) and is related to insufficient controls on files passed to a deletion function. It has been assigned a CVSS score of 7.5 (High) according to Patchstack, while WPScan rates it at 9.1 (Critical). The vulnerability is categorized under CWE-22 and is classified as a Local File Inclusion (LFI) type issue (WPScan, Patchstack).

The vulnerability allows unauthenticated attackers to delete arbitrary files from the affected WordPress installation. This can lead to denial of service or potential remote code execution, particularly if critical files such as wp-config.php are deleted. The impact is considered highly dangerous and is expected to become mass exploited (WPScan, Patchstack).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is considered low, making it particularly dangerous for affected installations (Patchstack).

The primary mitigation is to update the Simple File List plugin to version 6.1.10 or later, which contains the fix for this vulnerability. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).