{"affected":[{"defaultStatus":"unknown","product":"Somatic Framework","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.8.14","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-115735","cwes":["CWE-73"],"description":"The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/0a43de6d-7b65-4cc6-b02a-479bb79293cc/"}],"kev":null,"metrics":[],"modifiedAt":1794376807456,"publishedAt":1794376807456,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/0a43de6d-7b65-4cc6-b02a-479bb79293cc/"}],"remediation":[],"revision":"c7c32b11c6e8cb30116015e009b110269cb7b047bccc3c102a919520705ed4f1","sources":[{"modifiedAt":1794376807456,"name":"CNA: WPScan","retrievedAt":1794377360250,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115735"}],"ssvc":null,"status":"published","title":"Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion","updatedAt":1794377360250}