The vulnerability is an authorization bypass that allows authenticated users with subscriber or higher privileges to delete the site’s security.txt file from the server filesystem or create the .well‑known directory by directly invoking the delete_securitytxt or create_wellknown_folder AJAX actions. This bypass violates the expected capability checks, leading to a loss of an important security document and potentially exposing the site to misinformation or misconfiguration. The weakness is classified as CWE‑862, Missing Authorization.

The issue affects installations of the WordPress “Generate Security.txt” plugin from the vendor verenigingvanregistrars, specifically all versions up to and including 1.0.12.

The CVSS score of 4.3 indicates a moderate impact. Because the vulnerability requires the attacker to be authenticated, the likelihood of exploitation depends on the presence of susceptible subscriber‑level accounts. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be a legitimate logged‑in user making a crafted AJAX request, as the plugin does not enforce proper permission checks on those actions.