CVE-2026-11563
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Word Count and Social Shares WordPress plugin through version 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks. This allows any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g., by deleting wp-config.php).
Risk Assessment
The risk for the organization includes the possibility of a full WordPress site takeover by an unprivileged user, potentially leading to data loss, integrity compromise, and service disruption.
Recommendation
It is recommended to immediately update the plugin to the latest version or remove it entirely if no patch is available. Additionally, restrict user permissions and implement extra security measures such as a Web Application Firewall (WAF).
Original NVD description (English source)
The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).