CVE-2026-115735: Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion
The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role. An attacker does not need administrative privileges.
What does an attacker need to do to exploit it?
The attacker needs valid WordPress authentication and must be able to submit a user-controlled file path to the vulnerable deletion functionality. The issue exists because the plugin does not authorize the action or validate that path.
What is the potential impact of successful exploitation?
An attacker can delete arbitrary files on the server. This can result in a full site takeover.
Which plugin versions are affected?
Somatic Framework WordPress plugin versions through 1.8.14 are affected.