PeepSo CVE-2026-40805

Requires an authenticated WordPress account at Subscriber level or higher (PR:L) on a site running the PeepSo plugin version 9.0.5.4 or earlier; this is readily met where the site permits open user registration, which is common for PeepSo's social-community use case. No user interaction and no special non-default configuration is required beyond having the vulnerable plugin active. The main limiting factor is the need for a valid low-privilege account - fully anonymous unauthenticated exploitation is not possible - so sites that disable self-registration meaningfully raise the bar. Impact is limited to availability (arbitrary file deletion); there is no direct confidentiality or integrity disclosure, though deletion of critical files can indirectly enable broader site compromise.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7 HIGH) indicates a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, with a changed scope and high availability impact but no confidentiality or integrity impact. PR:L maps directly to the 'Subscriber' role named in the title, meaning any authenticated low-privilege account can exploit it - a meaningful signal on WordPress sites that allow open registration. The scope change (S:C) plus arbitrary file deletion is significant: although CVSS records only A:H, deletion of files such as wp-config.php can in practice cascade into full-site compromise, which is why scope is marked changed. However, the real-world exploitation signals are largely absent or unprovided: no EPSS probability was supplied, there is no CISA KEV listing, and no public POC is referenced - so this is currently a high-CVSS issue without confirmed active exploitation. Net assessment: a credible priority for sites permitting self-registration, but in the absence of EPSS/KEV/POC data it should be treated as patch-promptly rather than emergency. No key signals conflict with one another; the main gap is simply the missing exploitation-probability data.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running PeepSo <= 9.0.5.4, then submits a crafted request abusing the path-traversal flaw to delete an arbitrary file on the server. By deleting a critical file (e.g., wp-config.php or plugin files) the attacker can cause denial of service or force the site into a re-installation/takeover state. No public exploit identified at time of analysis, and the network vector with low attack complexity makes exploitation straightforward once a Subscriber account exists.