EUVD-2026-38675
GHSA-4vqg-xgxp-xqgh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible AJAX endpoint requires subscriber auth (PR:L); only integrity impact is file deletion or directory creation, no C or A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the site's security.txt file from the server filesystem or create the .well-known directory by directly invoking the delete_securitytxt or create_wellknown_folder AJAX actions.
AnalysisAI
Authorization bypass in the Generate Security.txt WordPress plugin (all versions through 1.0.12) allows authenticated attackers with subscriber-level access to delete the site's security.txt file or create the .well-known directory by invoking unprotected AJAX actions directly. The root cause is a failure to verify user capabilities before executing the delete_securitytxt and create_wellknown_folder AJAX handlers, a classic CWE-862 (Missing Authorization) pattern reported by Wordfence. No public exploit or CISA KEV listing has been identified at time of analysis, and with a CVSS score of 4.3 and limited integrity impact, this is a low-urgency but straightforward-to-exploit flaw for any authenticated WordPress user.
Technical ContextAI
The affected software is the 'Generate Security.txt' WordPress plugin (CPE: cpe:2.3:a:verenigingvanregistrars:generate_security.txt:*:*:*:*:*:*:*:*), developed by Vereniging van Registrars. The plugin provides functionality to generate and manage a site's security.txt file per RFC 9116, placing it under the .well-known/ directory. WordPress AJAX actions registered without proper nonce or capability checks are callable by any authenticated user regardless of role. CWE-862 (Missing Authorization) is confirmed: source references at class-generate-security-txt-admin.php lines 174, 1930, and 1963 in both 1.0.11 and 1.0.12 expose the delete_securitytxt and create_wellknown_folder handlers without verifying that the calling user holds an appropriate WordPress capability (e.g., manage_options). This allows any subscriber-tier account - the lowest default authenticated role in WordPress - to invoke destructive administrative filesystem operations.
RemediationAI
No vendor-released patch has been identified at time of analysis - all referenced versions (1.0.11 and 1.0.12) contain the vulnerable code. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d88cc2-91e4-4e53-8c46-93d6ce8bc320) for an updated release. As a compensating control, deactivate or remove the Generate Security.txt plugin entirely until a patched version is available; the security.txt file can be managed manually with no functional regression. If the plugin must remain active, restrict WordPress subscriber and contributor account creation and audit existing low-privilege accounts to reduce the pool of potential attackers. Web application firewalls can be configured to block direct AJAX calls to wp-admin/admin-ajax.php targeting the delete_securitytxt and create_wellknown_folder action parameters from non-administrator sessions, though this may interfere with legitimate plugin functionality.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today