Technical impact
The Word Count and Social Shares plugin for WordPress versions 1.0 and earlier fails to validate a file path supplied for deletion, and it has no authorization or CSRF protection. This allows any authenticated user, including those with the Subscriber role, to delete arbitrary files on the server. Removing critical files such as wp-config.php can cripple the site, effectively giving an attacker full control over the WordPress installation and compromising confidentiality, integrity, and availability.
Affected Systems
Word Count and Social Shares plugin versions 1.0 and earlier are affected. Any WordPress site that has the plugin installed and an authenticated user can trigger the deletion endpoint, exposing the site to arbitrary file removal.
Risk and Exploitability
The flaw carries a CVSS score of 9.6, classifying it as critical. The EPSS score of less than 1 % indicates a low current exploitation probability, but the vulnerability remains live. It is not listed in the CISA KEV catalog. An attacker only needs an authenticated WordPress session; a crafted request or form submission can delete files because the plugin lacks proper validation and protection.
