CVE-2026-9616

MediumCVSS 4.3/10Last modified Jun 25, 2026

Description

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the site's security.txt file from the server filesystem or create the .well-known directory by directly invoking the delete_securitytxt or create_wellknown_folder AJAX actions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-96178.8PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious cod CVE-2026-961735.3The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a CVE-2026-96184.3The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vul CVE-2026-961835.5Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose i CVE-2026-961857.5Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.CVE-2026-961867.8Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.CVE-2026-961887.3External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.CVE-2026-96194.3The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. CVE-2026-96206.4The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in ve CVE-2026-962005.3The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from CVE-2026-962028.8Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.CVE-2026-962046.5Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.