Somatic Framework: Arbitrary file deletion (CVE-2026-115735)
The Somatic Framework WordPress plugin through 1.8.14 is vulnerable to arbitrary file deletion by authenticated users due to a lack of authorization and path validation.
CVE search metadata
CVE search record: CVE-2026-115735. Severity: critical. CVSS: 9.6. EPSS: 0.19%. KEV: no. Product: Somatic Framework. Brief: Somatic Framework: Arbitrary file deletion (CVE-2026-115735). Brief link: https://feed.craftedsignal.io/briefs/2026-11-somatic-framework-file-deletion-cve-2026-115735/
Triage facts
Revision 1- Applicability
- Somatic Framework
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 16:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it. Any authenticated user, such as a subscriber, can delete arbitrary files on the server.
Impact
This vulnerability can lead to a full site takeover.
Recommendation
Upgrade the Somatic Framework WordPress plugin.