CVE-2026-9616: WordPress Generate Security.txt Auth Bypass

CVE-2026-9616 Overview

CVE-2026-9616 is an authorization bypass vulnerability in the Generate Security.txt plugin for WordPress, affecting all versions up to and including 1.0.12. The plugin fails to verify whether the requesting user is authorized to perform privileged actions exposed via AJAX endpoints. Authenticated attackers with subscriber-level access can invoke the delete_securitytxt and create_wellknown_folder AJAX actions. This permits deletion of the site's security.txt file or creation of the .well-known directory on the server filesystem. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can delete the site's security.txt file or create directories on the filesystem without authorization checks.

Affected Products

Generate Security.txt plugin for WordPress versions through 1.0.12
WordPress installations using the vulnerable plugin with open or weak user registration
Sites relying on the plugin to publish RFC 9116 security.txt disclosure metadata

Discovery Timeline

2026-06-24 - CVE-2026-9616 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9616

Vulnerability Analysis

The Generate Security.txt plugin exposes administrative functions through WordPress AJAX endpoints registered with the wp_ajax_ hook prefix. Two of these handlers, delete_securitytxt and create_wellknown_folder, perform sensitive filesystem operations. The handlers do not call current_user_can() or any equivalent capability check before executing their logic. Any user authenticated to WordPress, including subscriber accounts created through open registration, can invoke these endpoints directly.

The delete_securitytxt action removes the security.txt file generated by the plugin. The create_wellknown_folder action creates the .well-known directory at the web root. Removing security.txt breaks the published RFC 9116 contact channel used by external researchers for vulnerability disclosure. Creation of arbitrary directories may also interfere with other plugins or services that rely on .well-known for ACME challenges and federation metadata.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the affected AJAX handlers. The plugin registers the endpoints but omits both capability checks and nonce verification, so the server processes any authenticated request regardless of the caller's role. Source references for the vulnerable handlers are available in the WordPress plugin trac for version 1.0.12.

Attack Vector

An attacker first obtains a low-privileged WordPress account, typically through open subscriber registration. The attacker then sends an authenticated POST request to /wp-admin/admin-ajax.php with the action parameter set to delete_securitytxt or create_wellknown_folder. The handler executes without verifying the user's role. No user interaction beyond the attacker's own session is required. Refer to the Wordfence Vulnerability Report for further technical details.

Detection Methods for CVE-2026-9616

Indicators of Compromise

Unexpected deletion of the security.txt file from the .well-known directory of a WordPress site
Creation of a .well-known directory at the web root that was not provisioned by an administrator or ACME client
POST requests to /wp-admin/admin-ajax.php containing action=delete_securitytxt or action=create_wellknown_folder originating from subscriber-level accounts

Detection Strategies

Inspect web server access logs for AJAX requests targeting the two vulnerable actions and correlate the wordpress_logged_in_* cookie against the user's role
Monitor file integrity on wp-content, the web root, and the .well-known directory for unexpected create or delete events
Audit the WordPress user table for unexpected subscriber registrations preceding suspicious AJAX activity

Monitoring Recommendations

Enable a web application firewall rule that blocks unauthenticated and low-privileged requests to delete_securitytxt and create_wellknown_folder AJAX actions
Forward WordPress and web server logs to a centralized analytics platform and alert on anomalous admin-ajax.php action values from non-administrative roles
Track plugin version inventory across managed WordPress sites and alert when Generate Security.txt remains at 1.0.12 or earlier

How to Mitigate CVE-2026-9616

Immediate Actions Required

Update the Generate Security.txt plugin to a version newer than 1.0.12 once the vendor publishes a fix
Disable or remove the plugin if a patched version is not yet available
Disable open user registration or restrict the default role to limit the pool of accounts that can reach the AJAX endpoints
Restore the security.txt file if it has been deleted and verify the integrity of the .well-known directory

Patch Information

At the time of publication, all versions up to and including 1.0.12 are affected. Administrators should monitor the WordPress plugin repository for Generate Security.txt and the Wordfence advisory for an updated release that adds capability checks to the affected handlers.

Workarounds

Deploy a WAF or mod_security rule that denies requests to admin-ajax.php where the action parameter equals delete_securitytxt or create_wellknown_folder and the session does not belong to an administrator
Use a WordPress security plugin to enforce capability checks on AJAX actions or to filter requests by user role
Set restrictive filesystem permissions on the web root so the PHP process cannot create or delete files outside intended directories

bash

# Example nginx rule to block the vulnerable AJAX actions at the edge
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        set $block 0;
        if ($args ~* "action=(delete_securitytxt|create_wellknown_folder)") { set $block 1; }
        if ($request_body ~* "action=(delete_securitytxt|create_wellknown_folder)") { set $block 1; }
        if ($block = 1) { return 403; }
    }
}