CVE-2026-115734
Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download Path
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.
| Vendor | unknown |
| Product | pay with a tweet |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown pay with a tweet
Be the first to know when new unknown vulnerabilities affecting unknown pay with a tweet are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Pay with a tweet
0 ≤ 1.0.5
References
Credits
Naoki Kawahigashi WPScan