{"id":"CVE-2026-115734","kind":"vulnerability","aliases":["CVE-2026-115734"],"related":[],"title":"Pay with a tweet WordPress plugin lets subscribers delete arbitrary server files","description":"The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.","summary":"The Pay with a tweet WordPress plugin through 1.0.5 deletes files at a path it does not validate, and its admin screens lack access checks. A logged-in user with the lowest Subscriber role can delete arbitrary files on the server, which can lead to full site compromise.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pay-with-a-tweet","fixed":[],"affected":"<= 1.0.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["php","runtime","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"Look for wp-content/plugins/pay-with-a-tweet/ or 'Pay with a tweet' in Plugins > Installed Plugins (or run: wp plugin list). Any installed version, 1.0.5 or earlier, is affected.","fix":"No fixed version. The plugin is closed on WordPress.org (since 2026-10-26, pending review) and last released 1.0.5 in 2014. Remove and delete the plugin.","status":"open","published_at":"2026-11-11T06:17:13+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:53+00:00","updated_at":"2026-11-11T06:30:42+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-11-11T06:27:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Pay with a tweet WordPress plugin lets subscribers delete arbitrary server files","impact":"high","summary":"The Pay with a tweet WordPress plugin through 1.0.5 deletes files at a path it does not validate, and its admin screens lack access checks. A logged-in user with the lowest Subscriber role can delete arbitrary files on the server, which can lead to full site compromise.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker deletes arbitrary server files, enabling full site takeover","analyst_note":"Find the vendor or WPScan advisory for the fixed version of Pay with a tweet and confirm the patch status.","how_to_check":"- Check whether the `Pay with a tweet` plugin is installed and its version is `1.0.5` or earlier in the WordPress admin plugin list\n- Check the plugin's installed version in `wp-content/plugins/` against the vendor's fixed release","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Any WordPress site running the Pay with a tweet plugin version 1.0.5 or earlier is exposed, as long as attackers can register or hold a Subscriber account. Sites without the plugin, or running a newer version, are not affected. The sources do not give a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4545,"output_tokens":566,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor or WPScan advisory for the fixed version of Pay with a tweet and confirm the patch status.","search":"'-115734':15A,18A '-2026':14A,17A '1.0.5':38B,87C 'a':22A 'access':53B,101C 'admin':50B 'administr':105C 'allow':107C 'arbitrari':10A,67B,118C 'check':54B 'compromis':78B,130C 'cve':13A,16A 'delet':9A,39B,66B,95C,117C 'file':12A,40B,68B,92C,119C 'full':76B,128C 'host':28B 'lack':52B 'lead':74B,125C 'let':7A 'log':57B 'logged-in':56B 'low':113C 'lowest':62B 'path':43B,93C 'pay':1A,20A,31B,80C 'pay-with-a-tweet':19A 'php':24B 'plugin':6A,36B,85C 'relev':104C 'restrict':100C 'role':64B,111C 'runtim':25B 'screen':51B,106C 'self':27B 'self-host':26B 'server':11A,71B,122C 'site':77B,129C 'subscrib':8A,63B,115C 'tweet':4A,23A,34B,83C 'user':59B,108C 'valid':47B,90C 'with':21A 'wordpress':5A,29B,35B,84C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted WordPress site with the Pay with a tweet plugin (1.0.5 or earlier) installed and active is exposed to anyone with a Subscriber account, including self-registered ones if registration is open. Sites without the plugin can skip it. No patched version is listed; the plugin is closed on WordPress.org.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["paywithatweet"],"ptokens":["pay","tweet","with"],"labels":["high","php","runtime","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-115734':15A,18A '-2026':14A,17A 'a':22A 'arbitrari':10A 'cve':13A,16A 'delet':9A 'file':12A 'let':7A 'pay':1A,20A 'pay-with-a-tweet':19A 'plugin':6A 'server':11A 'subscrib':8A 'tweet':4A,23A 'with':21A 'wordpress':5A","search_b":"'1.0.5':38B 'access':53B 'admin':50B 'arbitrari':67B 'check':54B 'compromis':78B 'delet':39B,66B 'file':40B,68B 'full':76B 'host':28B 'lack':52B 'lead':74B 'log':57B 'logged-in':56B 'lowest':62B 'path':43B 'pay':31B 'php':24B 'plugin':36B 'role':64B 'runtim':25B 'screen':51B 'self':27B 'self-host':26B 'server':71B 'site':77B 'subscrib':63B 'tweet':34B 'user':59B 'valid':47B 'wordpress':29B,35B","search_c":"'1.0.5':87C 'access':101C 'administr':105C 'allow':107C 'arbitrari':118C 'compromis':130C 'delet':95C,117C 'file':92C,119C 'full':128C 'lead':125C 'low':113C 'path':93C 'pay':80C 'plugin':85C 'relev':104C 'restrict':100C 'role':111C 'screen':106C 'server':122C 'site':129C 'subscrib':115C 'tweet':83C 'user':108C 'valid':90C 'wordpress':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115734","severity":null,"published_at":"2026-11-11T06:17:13+00:00","modified_at":"2026-11-11T06:17:13+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115734:3513","url":"https://wordpress.org/plugins/pay-with-a-tweet/","severity":null,"published_at":"2026-11-11T06:30:42+00:00","modified_at":"2026-11-11T06:30:42+00:00","first_seen_at":"2026-11-11T06:30:42+00:00","fetched_at":"2026-11-11T06:30:42+00:00","note":"WordPress.org page (read): plugin closed 2026-10-26, latest 1.0.5, no fix. No WPScan page found. Not verified: page states closure, not an explicit no-fix; exploit status unknown.","cites":["https://wordpress.org/plugins/pay-with-a-tweet/"]}],"documents":[{"id":123310,"url":"https://wordpress.org/plugins/pay-with-a-tweet/","title":"Pay with a tweet – WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin closed as of October 26, 2026, not available for download; closure temporary pending full review. Version 1.0.5, last updated 12 years ago (2014).","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}