{"affected":[{"defaultStatus":"unknown","product":"Pay with a tweet","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.5","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-115734","cwes":["CWE-73"],"description":"The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/73fea81f-2611-4230-a159-c182c3045f2d/"}],"kev":null,"metrics":[],"modifiedAt":1794376807276,"publishedAt":1794376807276,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/73fea81f-2611-4230-a159-c182c3045f2d/"}],"remediation":[],"revision":"07782985fc3d6e6f09589fa13420e0389559123d9ab977802c47082f04d3e3ef","sources":[{"modifiedAt":1794376807276,"name":"CNA: WPScan","retrievedAt":1794377359119,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115734"}],"ssvc":null,"status":"published","title":"Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download Path","updatedAt":1794377359119}