Somatic Framework - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/somatic-framework/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 16:07:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSomatic Framework: Arbitrary file deletion (CVE-2026-115735)https://feed.craftedsignal.io/briefs/2026-11-somatic-framework-file-deletion-cve-2026-115735/Wed, 11 Nov 2026 16:07:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-somatic-framework-file-deletion-cve-2026-115735/The Somatic Framework WordPress plugin through 1.8.14 is vulnerable to arbitrary file deletion by authenticated users due to a lack of authorization and path validation.The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it. Any authenticated user, such as a subscriber, can delete arbitrary files on the server.

Impact

This vulnerability can lead to a full site takeover.

Recommendation

Upgrade the Somatic Framework WordPress plugin.

]]>criticaladvisory