{"id":"CVE-2026-115735","kind":"vulnerability","aliases":["CVE-2026-115735"],"related":[],"title":"Somatic Framework WordPress plugin: any logged-in user can delete server files","description":"The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover.","summary":"The Somatic Framework WordPress plugin through version 1.8.14 does not check permissions or validate a file path before deleting it. Any authenticated user, including a subscriber, can delete arbitrary files on the server, which can lead to full site takeover.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Somatic Framework","fixed":[],"affected":"<= 1.8.14","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["auth-required","other","somatic-framework","wordpress","wordpress-plugin"],"not_affected_if":["no-authenticated-users","plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, look for Somatic Framework; version 1.8.14 or earlier is affected (1.8.14 is the latest release listed). Or run: wp plugin list --name=somatic-framework. Also check whether public registration is enabled (Settings > General > Membership), since any subscriber account can reach the flaw.","fix":"No fixed version known. The WordPress.org listing shows 1.8.14 as the latest release and the plugin is closed as of 2026-10-26 (described as temporary, pending review). Deactivate and delete the plugin, or restrict registration, until a patched release appears.","status":"open","published_at":"2026-11-11T06:17:13+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:50+00:00","updated_at":"2026-11-11T06:30:41+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T06:27:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Somatic Framework WordPress plugin: any logged-in user can delete server files","impact":"high","summary":"The Somatic Framework WordPress plugin through version 1.8.14 does not check permissions or validate a file path before deleting it. Any authenticated user, including a subscriber, can delete arbitrary files on the server, which can lead to full site takeover.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","somatic-framework"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary server files deleted, leading to full site takeover","analyst_note":"Find the fixed version and vendor advisory for the Somatic Framework plugin; the NVD entry gives no fix or severity.","how_to_check":"- Check the installed Somatic Framework plugin version in the WordPress admin under Plugins; versions through `1.8.14` are described as affected.\n- unknown","plain_action":"","product_name":"Somatic Framework","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-authenticated-users"],"who_is_affected":"Sites running the Somatic Framework WordPress plugin at version 1.8.14 or earlier. The flaw requires any logged-in account, including the lowest subscriber role, so sites that allow public registration are most exposed. The sources do not say which configurations are safe.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4537,"output_tokens":549,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed version and vendor advisory for the Somatic Framework plugin; the NVD entry gives no fix or severity.","search":"'-115735':16A,19A '-2026':15A,18A '1.8.14':40B,79C 'allow':97C 'arbitrari':61B,107C 'auth':23B 'auth-requir':22B 'authent':54B,99C 'author':84C 'check':43B,85C 'cve':14A,17A 'delet':11A,51B,60B,95C,106C 'file':13A,48B,62B,92C,108C 'framework':2A,21A,28B,35B,75C 'full':70B,117C 'includ':56B 'lead':68B,114C 'log':7A 'logged-in':6A 'path':49B,93C 'perform':82C 'permiss':44B 'plugin':4A,32B,37B,77C 'requir':24B 'server':12A,65B,111C 'site':71B,118C 'somat':1A,27B,34B,74C 'somatic':20A 'somatic-framework':26B 'subscrib':58B,104C 'suppli':91C 'takeov':72B,119C 'user':9A,55B,90C,100C 'user-suppli':89C 'valid':46B,87C 'version':39B 'wordpress':3A,29B,31B,36B,76C 'wordpress-plugin':30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Somatic Framework WordPress plugin at 1.8.14 or earlier, which is every published version. Any logged-in account, including a subscriber, can delete server files, so sites with open registration or many users are most exposed. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["framework","somaticframework"],"ptokens":["framework","somatic"],"labels":["authrequired","high","other","somaticframework","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-115735':16A,19A '-2026':15A,18A 'cve':14A,17A 'delet':11A 'file':13A 'framework':2A,21A 'log':7A 'logged-in':6A 'plugin':4A 'server':12A 'somat':1A 'somatic':20A 'user':9A 'wordpress':3A","search_b":"'1.8.14':40B 'arbitrari':61B 'auth':23B 'auth-requir':22B 'authent':54B 'check':43B 'delet':51B,60B 'file':48B,62B 'framework':28B,35B 'full':70B 'includ':56B 'lead':68B 'path':49B 'permiss':44B 'plugin':32B,37B 'requir':24B 'server':65B 'site':71B 'somat':27B,34B 'somatic-framework':26B 'subscrib':58B 'takeov':72B 'user':55B 'valid':46B 'version':39B 'wordpress':29B,31B,36B 'wordpress-plugin':30B","search_c":"'1.8.14':79C 'allow':97C 'arbitrari':107C 'authent':99C 'author':84C 'check':85C 'delet':95C,106C 'file':92C,108C 'framework':75C 'full':117C 'lead':114C 'path':93C 'perform':82C 'plugin':77C 'server':111C 'site':118C 'somat':74C 'subscrib':104C 'suppli':91C 'takeov':119C 'user':90C,100C 'user-suppli':89C 'valid':87C 'wordpress':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115735","severity":null,"published_at":"2026-11-11T06:17:13+00:00","modified_at":"2026-11-11T06:17:13+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115735:3512","url":"https://wordpress.org/plugins/somatic-framework/","severity":null,"published_at":"2026-11-11T06:30:41+00:00","modified_at":"2026-11-11T06:30:41+00:00","first_seen_at":"2026-11-11T06:30:41+00:00","fetched_at":"2026-11-11T06:30:41+00:00","note":"NVD gives no fix; wordpress.org page lists 1.8.14 as latest and shows the plugin closed 2026-10-26 pending review. No vendor advisory, no PoC, no exploitation found. Web search found nothing further; X not checked. Nothing marked verified (the closure page is not an advisory on the flaw).","cites":["https://wordpress.org/plugins/somatic-framework/","https://nvd.nist.gov/vuln/detail/CVE-2026-115735"]}],"documents":[{"id":123311,"url":"https://wordpress.org/plugins/somatic-framework/","title":"Somatic Framework – WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Current version 1.8.14. Page says the plugin has been closed as of October 26, 2026 and is not available for download; closure described as temporary pending a full review.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":123312,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115735","title":"NVD CVE-2026-115735","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}