SOMATIC FRAMEWORK · CVE-2026-115735 · Other
NO FIX YET · SEE WHAT TO DO
The Somatic Framework WordPress plugin through version 1.8.14 does not check permissions or validate a file path before deleting it. Any authenticated user, including a subscriber, can delete arbitrary files on the server, which can lead to full site takeover.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Somatic Framework WordPress plugin at 1.8.14 or earlier, which is every published version. Any logged-in account, including a subscriber, can delete server files, so sites with open registration or many users are most exposed. Sites without the plugin can skip it.
Not affected if no-authenticated-users, plugin-not-installed
Who cares auth-required, somatic-framework, wordpress, wordpress-plugin
1.8.14 or earlier is affected (1.8.14 is the latest release listed)1.8.14 as the latest release and the plugin is closed as of 2026-10-26 (described as temporary, pending review)Posts are quoted with a link to the original. They are data to us, never instructions.
The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.