Description
The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).
Published: 2026-07-14
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Word Count and Social Shares plugin for WordPress versions 1.0 and earlier fails to validate a file path supplied for deletion, and it has no authorization or CSRF protection. This allows any authenticated user, including those with the Subscriber role, to delete arbitrary files on the server. Removing critical files such as wp-config.php can cripple the site, effectively giving an attacker full control over the WordPress installation and compromising confidentiality, integrity, and availability.

Affected Systems

Word Count and Social Shares plugin versions 1.0 and earlier are affected. Any WordPress site that has the plugin installed and an authenticated user can trigger the deletion endpoint, exposing the site to arbitrary file removal.

Risk and Exploitability

The flaw carries a CVSS score of 9.6, classifying it as critical. The EPSS score of less than 1 % indicates a low current exploitation probability, but the vulnerability remains live. It is not listed in the CISA KEV catalog. An attacker only needs an authenticated WordPress session; a crafted request or form submission can delete files because the plugin lacks proper validation and protection.

Generated by OpenCVE AI on August 3, 2026 at 03:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Disable or delete the Word Count and Social Shares plugin to eliminate the deletion endpoint
  • Restrict file‑system permissions to prevent the WordPress web‑server user from deleting critical files such as wp-config.php
  • Check the plugin vendor’s website for any official patch or update and apply when available

Generated by OpenCVE AI on August 3, 2026 at 03:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-284
CWE-352

Sat, 25 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-284
CWE-352

Wed, 22 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
CWE-284
CWE-352

Thu, 16 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
CWE-284
CWE-352

Tue, 14 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).
Title Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-14T13:04:45.925Z

Reserved: 2026-06-08T07:57:39.644Z

Link: CVE-2026-11563

cve-icon Vulnrichment

Updated: 2026-07-14T13:04:42.199Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T03:45:05Z

Weaknesses

No weakness.