CVE-2026-115734

Name of the Vulnerable Software and Affected Versions Pay with a tweet versions prior to 1.0.6

Description Insufficient validation of the file path before deletion and a lack of access restrictions on administration screens allow users with the Subscriber role or higher to delete arbitrary files on the server. This issue occurs via the button download path and can lead to a full site compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.