CVE-2026-9616

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the site's security.txt file from the server filesystem or create the .well-known directory by directly invoking the delete_securitytxt or create_wellknown_folder AJAX actions.

• CWE-862

• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L174
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L1930
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L1963
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L174
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L1930
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L1963
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d88cc2-91e4-4e53-8c46-93d6ce8bc320?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9610IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigato…5.3
• CVE-2026-9611Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-9612The WhatsOrder – Instant Checkout for WooCommerce plugin for…5.3
• CVE-2026-9613The Datalogics Ecommerce Delivery – Datalogics plugin for Wo…4.3
• CVE-2026-9614An Improper Access Control vulnerability in Ivanti Neurons f…8.8
• CVE-2026-9615The Flex Import plugin for WordPress is vulnerable to Missin…4.3
• CVE-2026-9617PostgreSQL Anonymizer contains a vulnerability that allows a…8.8
• CVE-2026-9618The PeachPay — Payments & Express Checkout for WooCommerce (…4.3
• CVE-2026-9619The Reviews and Rating – Docplanner plugin for WordPress is …4.3
• CVE-2026-9620The WP Latest Posts plugin for WordPress is vulnerable to St…6.4
• CVE-2026-9621A denial-of-service security issue exists within RSLinx® Cla…9.2
• CVE-2026-9622A denial-of-service security issue exists within RSLinx® Cla…8.7