CVE-2026-115734
The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the rel
CVSS
9.6
Critical
EPSS
0.2%
p9
KEV
—
Exploit Today
3
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-73
Not enough EPSS history yet.
The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1267797.5 HIG—
———Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.6hCVE-2026-1109926.5 MED—
———A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.10hCVE-2026-1157359.6 CRI8.8%
——3The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover.13hCVE-2026-1199766.5 MED53.9%
——16External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose information over a network.1dCVE-2026-1199397.8 HIG30.7%
——9Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.1dCVE-2026-1181517.2 HIG65.5%
——20External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.1d