WordPress Generate Security.txt <= 1.0.12 Authorization Bypass to Delete security.txt via AJAX (CVE-2026-9616)

Vulnerability Overview Vulnerability Name: Generate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action Vulnerability Description: The Generate Security.txt plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to 1.0.12. This issue arises because the plugin fails to properly verify whether a user has permission to perform the action, allowing authenticated attackers (with Subscriber privileges or higher) to delete the security.txt file on the server’s file system or create the .well-known directory. CVSS Score: 4.3 (Medium) CVE Number: CVE-2026-9616 Release Date: June 23, 2026 Last Updated: June 24, 2026 Researcher: Benedictus Jovan (allessM) Scope of Impact Software Type: Plugin Software Name: generate-security-txt Affected Versions: <= 1.0.12 Remediation Patch Status: No known patch available Recommended Actions: Review the vulnerability details thoroughly and implement mitigation measures based on your organization's risk tolerance. Uninstalling the affected software and seeking an alternative may be necessary. References plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material provided by Defiant Inc. and The MITRE Corporation. Contact: For errors or to add information, please contact wfsupport@wordfence.com. Summary The Generate Security.txt plugin contains an authorization bypass vulnerability affecting versions <= 1.0.12. Users are advised to review the issue and take appropriate actions as soon as possible to prevent potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Generate Security.txt <= 1.0.12 Authorization Bypass to Delete security.txt via AJAX (CVE-2026-9616)

More from this source