CVE-2026-11563 Overview
CVE-2026-11563 affects the Word Count and Social Shares WordPress plugin through version 1.0. The plugin fails to validate user-supplied file paths before deletion and lacks proper authorization and Cross-Site Request Forgery (CSRF) checks. Any authenticated user, including low-privileged Subscriber accounts, can delete arbitrary files on the server. Deleting critical files such as wp-config.php triggers WordPress reinstallation flows and can lead to full site takeover.
Critical Impact
A Subscriber-level account can delete wp-config.php and hijack the WordPress site by pointing reinstallation to an attacker-controlled database.
Affected Products
- Word Count and Social Shares WordPress plugin — all versions through 1.0
- WordPress sites running the plugin with open user registration enabled
- Any WordPress installation where Subscriber or higher accounts exist
Discovery Timeline
- 2026-07-14 - CVE-2026-11563 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-11563
Vulnerability Analysis
The Word Count and Social Shares plugin exposes a file deletion handler that accepts a file path parameter from the request without validation. The handler performs the deletion using the web server's file system privileges, typically the same user that runs PHP-FPM or Apache. Because the plugin does not restrict access to administrators and does not verify a CSRF nonce, any authenticated session can invoke the endpoint.
The combined absence of path validation, capability checks, and CSRF protection makes this a Broken Access Control issue paired with a Path Traversal primitive. An attacker traverses outside the plugin directory and targets sensitive WordPress files anywhere the web server can write.
Root Cause
The root cause is missing authorization and input validation in the plugin's file deletion action. The handler does not call current_user_can() with an appropriate capability such as manage_options, does not verify a nonce via check_admin_referer() or wp_verify_nonce(), and does not canonicalize or whitelist the target path. These omissions collapse three defenses at once.
Attack Vector
An attacker registers a Subscriber account on any site that permits self-registration. The attacker then sends a crafted request to the vulnerable plugin action, supplying an absolute or relative path to wp-config.php or another critical file. After deletion of wp-config.php, the attacker visits the site to trigger the WordPress setup wizard and reconfigures the installation against a database they control, granting administrative access.
The vulnerability requires network access, low privileges, and no user interaction. Detailed exploitation notes are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-11563
Indicators of Compromise
- Unexpected absence of wp-config.php or presence of the WordPress installation screen on a previously configured site
- POST requests from Subscriber-level accounts to admin-ajax.php or plugin endpoints referencing file paths containing ../ or absolute paths
- Newly created administrator accounts following a site reinstallation event
- Web server error logs showing PHP unlink() calls against paths outside the plugin directory
Detection Strategies
- Monitor HTTP request bodies and query strings for path traversal sequences targeting plugin AJAX actions
- Alert on file system delete events for wp-config.php, .htaccess, and files under wp-content/uploads
- Correlate low-privilege authentication events with subsequent administrative configuration changes
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin action invocations and user role changes
- Ingest web server access logs into a centralized platform and hunt for anomalous parameters to plugin endpoints
- Track file integrity for the WordPress core directory and generate alerts on deletions of configuration files
How to Mitigate CVE-2026-11563
Immediate Actions Required
- Deactivate and remove the Word Count and Social Shares plugin from all WordPress installations
- Disable open user registration or restrict the default role to prevent unauthenticated actors from obtaining Subscriber accounts
- Audit the WordPress wp-content/plugins directory for the presence of this plugin across all managed sites
- Restore wp-config.php from backup and rotate database credentials and secret keys if deletion is suspected
Patch Information
No vendor patch is available at the time of publication. The plugin is vulnerable through version 1.0. Refer to the WPScan Vulnerability Report for updated remediation status.
Workarounds
- Remove the plugin entirely until a patched release is issued
- Apply a Web Application Firewall (WAF) rule that blocks requests to the plugin's AJAX action containing path traversal sequences or references to wp-config.php
- Restrict file system permissions so that the web server user cannot delete files outside wp-content/uploads
- Set DISALLOW_FILE_MODS to true in wp-config.php on production sites where plugin management is not required
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate word-count-and-social-shares
wp plugin delete word-count-and-social-shares
# Harden wp-config.php against modification
chmod 440 wp-config.php
chown root:www-data wp-config.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
