CVE-2026-115734: Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download Path
The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with a Subscriber role or higher can exploit it. The affected plugin administration screens are not properly restricted by role.
What does an attacker need to do?
The attacker needs a valid WordPress account with at least Subscriber access and access to the relevant plugin administration functionality. They can provide an arbitrary server file path for deletion.
Are default WordPress roles affected?
Yes. Subscriber is a standard WordPress role, so sites that allow subscriber registration or have untrusted subscriber accounts may be exposed.
What is the impact of successful exploitation?
An attacker can delete arbitrary files on the server. The described impact can escalate to full site compromise.
What should be done if an update cannot be applied immediately?
Remove or disable the plugin and restrict or remove untrusted Subscriber accounts where possible. Review server and WordPress files for unexpected deletions, especially if untrusted users could access the affected administration screens.