CVE-2026-9616

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the site's security.txt file from the server filesystem or create the .well-known directory by directly invoking the delete_securitytxt or create_wellknown_folder AJAX actions.

• CWE-862

• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L174
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L1930
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L1963
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L174
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L1930
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L1963
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d88cc2-91e4-4e53-8c46-93d6ce8bc320?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9608A vulnerability was determined in QianFox FoxCMS up to 1.2.6…2.4
• CVE-2026-9609A vulnerability was identified in QianFox FoxCMS up to 1.2.6…4.7
• CVE-2026-9610IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigato…5.3
• CVE-2026-9611Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-9612The WhatsOrder – Instant Checkout for WooCommerce plugin for…5.3
• CVE-2026-9614An Improper Access Control vulnerability in Ivanti Neurons f…8.8
• CVE-2026-9617PostgreSQL Anonymizer contains a vulnerability that allows a…8.8
• CVE-2026-9618The PeachPay — Payments & Express Checkout for WooCommerce (…4.3
• CVE-2026-9619The Reviews and Rating – Docplanner plugin for WordPress is …4.3
• CVE-2026-9620The WP Latest Posts plugin for WordPress is vulnerable to St…6.4
• CVE-2026-9626The JSON API User plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-9627A security flaw has been discovered in UTT HiPER 1200GW up t…8.8