CPE
The Pay with a tweet WordPress plugin through 1.0.5 lacks input validation and access control on administrative deletion functions, allowing authenticated low-privileged users to delete arbitrary files and achieve site compromise.