WordPress Plugin Vulnerabilities

Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal

Description

The plugin does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).

Proof of Concept

Affects Plugins

Plugin icon
word-count-and-social-shares
No known fix

References

CVE
CVE-2026-11563

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
9.6 (critical)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
7f4b5f16-6c31-4dcc-94a4-120cb45631bb

Timeline

Publicly Published
2026-06-23 (about 2 months ago)
Added
2026-06-23 (about 2 months ago)
Last Updated
2026-09-15 (about 4 hours ago)

Other

Published
Title
Published
2025-03-19
Title
Order Export & Order Import for WooCommerce < 2.6.1 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
Published
2026-04-10
Title
wpForo Forum < 3.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
Published
2026-05-19
Title
Kirki < 6.0.7 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Published
2025-12-11
Title
WP User Manager < 2.9.13 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
Published
2026-08-11
Title
Formidable Digital Signatures < 3.1 - Unauthenticated Arbitrary File Deletion via Signature Field