Authorization Bypass in Generate Security.txt Plugin for WordPress

CVE-2026-9616

What is CVE-2026-9616?

The Generate Security.txt plugin for WordPress includes a significant security flaw that allows authenticated users, specifically those with subscriber-level access or higher, to bypass authorization checks. This vulnerability enables such users to delete the site's security.txt file or create the .well-known directory through the misuse of AJAX actions such as delete_securitytxt and create_wellknown_folder. The issue extends across all versions up to and including 1.0.12, posing a risk to the integrity of security settings on affected WordPress sites.

References