Pay with a tweet WordPress plugin: Arbitrary file deletion (CVE-2026-115734)
The Pay with a tweet WordPress plugin through 1.0.5 lacks input validation and access control on administrative deletion functions, allowing authenticated low-privileged users to delete arbitrary files and achieve site compromise.
CVE search metadata
CVE search record: CVE-2026-115734. Severity: critical. CVSS: 9.6. KEV: no. Product: Pay with a tweet (<= 1.0.5). Brief: Pay with a tweet WordPress plugin: Arbitrary file deletion (CVE-2026-115734). Brief link: https://feed.craftedsignal.io/briefs/2026-11-pay-with-a-tweet-arbitrary-file-deletion-cve-2026-115734/
Triage facts
Revision 1- Applicability
- Pay with a tweet (<= 1.0.5)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-115734 identifies a critical security vulnerability in the "Pay with a tweet" WordPress plugin. The plugin fails to validate file paths before performing deletion operations and does not restrict access to these functions to administrative users. An attacker with Subscriber-level privileges can trigger these insecure endpoints to delete arbitrary files on the web server, which may facilitate a full site takeover.
Impact
Successful exploitation allows for the deletion of arbitrary files on the web server. This can lead to a complete site compromise, potentially including the removal of core WordPress files, configuration files, or security-critical plugins.
Recommendation
- Inventory all WordPress instances running the "Pay with a tweet" plugin.
- Disable or remove the plugin until a patch is released by the vendor.
- Monitor web server access logs for anomalous POST requests to administrative endpoints originating from low-privileged user accounts.
- Enforce strict file system permissions for the web server user to prevent the deletion of sensitive system files.
Immediate actions
Identify and disable Pay with a tweet plugin version 1.0.5 or lower in the production environment.
Threat Hunt
Hunt for POST requests to administrative or file-handling endpoints originating from user accounts with "Subscriber" roles.
Data: Web access logs including request method, URI, and authenticated user ID or session context
Mitigations
Disable or uninstall the plugin until a vendor-supplied patch is available.
CVE-2026-115734