PT-2026-51697 · WordPress · Generate Security.Txt

Benedictus Jovan · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-9616

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Generate Security.txt plugin for WordPress versions prior to 1.0.13

Description The plugin fails to properly verify user authorization for specific actions. This allows authenticated attackers with subscriber-level access or higher to delete the site's security.txt file from the server filesystem or create the .well-known directory. This is achieved by directly invoking the AJAX actions delete securitytxt and create wellknown folder.

Recommendations Update the plugin to version 1.0.13 or later. As a temporary workaround, restrict access to the delete securitytxt and create wellknown folder AJAX actions for users with low-level privileges.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-9616

Affected Products

Generate Security.Txt

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-9616 · Security Note
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L174 · Note
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L1963 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b8d88cc2-91e4-4e53-8c46-93d6ce8bc320?source=cve · Note
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L174 · Note
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.12/admin/class-generate-security-txt-admin.php#L1930 · Note
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L1963 · Note
• https://plugins.trac.wordpress.org/browser/generate-security-txt/tags/1.0.11/admin/class-generate-security-txt-admin.php#L1930 · Note
• https://twitter.com/atomicedgeWAF/status/2069726313804345621 · Twitter Post