Pay with a Tweet: Arbitrary file deletion by Subscriber-level users
Summary
The Pay with a Tweet WordPress plugin through version 1.0.5 deletes files without validating the file path and does not restrict access to its administration screens. An authenticated user with the lowest role, Subscriber, can delete arbitrary files on the server. Deleting files such as wp-config.php can lead to a full compromise of the website.
Affected
- Pay with a Tweet WordPress plugin, versions 0 through 1.0.5 (according to the CVE record and WPScan)
- Sites where the plugin is installed and users can obtain a Subscriber account (for example through open registration)
Fixed in
Unknown. No vendor advisory or confirmed fixed release was found. VulDB claims that version 1.0.6 or later fixes the issue, but this has not been verified.
Workaround
- Deactivate and remove the plugin if it is not essential.
- Disable open user registration if it is not needed, and remove or restrict Subscriber accounts.
- Restrict file permissions so the web server user cannot delete files it does not need.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No known exploitation in the wild and no public exploit in Metasploit, Exploit-DB or as a Nuclei template, as of 10 to 11 November 2026.
- Whether a public proof of concept exists is unknown.
Our recommendation
- Check whether the plugin is installed on any WordPress site.
- If it is installed, remove it. If removal is not possible, disable self-registration and audit all Subscriber accounts.
- Create and test backups, and keep copies of critical files such as wp-config.php off the server.
- Monitor for unexpected file deletions and for new or changed user accounts.
- Check the official WordPress.org listing for a fixed release before assuming a patch exists.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- CVE Record CVE-2026-115734 www.cve.org
- OpenCVE CVE-2026-115734 app.opencve.io
- VulDB CVE-2026-115734 (third-party, fix version unverified) vuldb.com
- OffSeq Radar threat entry (exploitation status) radar.offseq.com
- Strix CVE entry (CVSS status) www.strix.ai
- WordPress.com plugin listing wordpress.com
- Plugin readme on GitHub github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:21.
Original description (NVD)
The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.