CVE-2026-11563

Name of the Vulnerable Software and Affected Versions Word Count and Social Shares versions prior to 1.1

Description The plugin fails to validate user-supplied file paths before deletion and lacks proper authorization and Cross-Site Request Forgery (CSRF) checks. This allows any authenticated user, including those with Subscriber-level access, to delete arbitrary files on the server. Deleting critical files such as wp-config.php can lead to a full site takeover or remote code execution.

Recommendations Update the plugin to a version newer than 1.0.