PAY-WITH-A-TWEET · CVE-2026-115734 · Runtime
NO FIX YET · SEE WHAT TO DO
The Pay with a tweet WordPress plugin through 1.0.5 deletes files at a path it does not validate, and its admin screens lack access checks. A logged-in user with the lowest Subscriber role can delete arbitrary files on the server, which can lead to full site compromise.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any self-hosted WordPress site with the Pay with a tweet plugin (1.0.5 or earlier) installed and active is exposed to anyone with a Subscriber account, including self-registered ones if registration is open. Sites without the plugin can skip it. No patched version is listed; the plugin is closed on WordPress.org.
Not affected if newer-version, plugin-not-installed
Who cares php, self-hosted, wordpress
Pay with a tweet in Plugins > Installed Plugins (or run: wp plugin list)1.0.5 or earlier, is affected1.0.5 in 2014The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.