Skip to content

CVE-2026-115735 Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion

CriticalCVSS 9.6
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover.

Affected products

No affected product data has been published yet.

References

  • wpscan.com exploit technical-description vdb-entry