Cpe:2.3:a:pay_with_a_tweet_project:pay_with_a_tweet:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apay_with_a_tweet_projectpay_with_a_tweetwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:59:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPay with a tweet WordPress plugin: Arbitrary file deletion (CVE-2026-115734)https://feed.craftedsignal.io/briefs/2026-11-pay-with-a-tweet-arbitrary-file-deletion-cve-2026-115734/Wed, 11 Nov 2026 13:59:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pay-with-a-tweet-arbitrary-file-deletion-cve-2026-115734/The Pay with a tweet WordPress plugin through 1.0.5 lacks input validation and access control on administrative deletion functions, allowing authenticated low-privileged users to delete arbitrary files and achieve site compromise.CVE-2026-115734 identifies a critical security vulnerability in the "Pay with a tweet" WordPress plugin. The plugin fails to validate file paths before performing deletion operations and does not restrict access to these functions to administrative users. An attacker with Subscriber-level privileges can trigger these insecure endpoints to delete arbitrary files on the web server, which may facilitate a full site takeover.

Impact

Successful exploitation allows for the deletion of arbitrary files on the web server. This can lead to a complete site compromise, potentially including the removal of core WordPress files, configuration files, or security-critical plugins.

Recommendation

  • Inventory all WordPress instances running the "Pay with a tweet" plugin.
  • Disable or remove the plugin until a patch is released by the vendor.
  • Monitor web server access logs for anomalous POST requests to administrative endpoints originating from low-privileged user accounts.
  • Enforce strict file system permissions for the web server user to prevent the deletion of sensitive system files.
]]>criticaladvisorywordpressarbitrary-file-deletioncve-2026-115734